topic Re: Top DNS queries from DNS logs in Getting Data In

Top DNS queries from DNS logs

tevgey23 — Wed, 15 Aug 2012 16:38:53 GMT

Hello,

I wanted to know what would be the best way to see the top 20 FQDN coming from DNS

To get to the results below I had to run this command

index="MyDNSlog" sourcetype=dns | rex mode=sed "s/\(\d+\)/./g" 

8/15/2012 10:27:11 AM 08E8 PACKET  000000000443D750 UDP Snd 192.168.44.2     0f93 R Q [8085 A DR  NOERROR] A      .google.com.

host=MYDNS Options| sourcetype=dns Options| source=C:\dir\dns444.log Options| timeendpos=22 Options

How can I further extract the domain name in order to view top 20 DNS queries

Thank you

Re: Top DNS queries from DNS logs

kristian_kolb — Wed, 15 Aug 2012 17:19:27 GMT

If you want the google.com or amazon.com or dummy.domain.here at the end of the event, something like this should do;

...| rex "\s+\.(?<domain>.+)\.$" | top 20 domain

hope this helps,

Kristian

Re: Top DNS queries from DNS logs

tevgey23 — Wed, 15 Aug 2012 18:20:28 GMT

Thank you very much. That works