same BIND logs parsing different

bluaces — Thu, 07 Nov 2019 07:19:47 GMT

Good morning all,

I got two DNS servers, mirrors one of the other, that are sending logs to splunk via Syslog.

Doing some research I found that one of the hosts logs are being properly parsed but the logs for the other ones are not.

properly parsed query

unparsed query

Both systems logs are stored in the same index and use the same sourcetype.

Any help will be really appreciated.

Re: same BIND logs parsing different

codebuilder — Fri, 15 Nov 2019 05:25:22 GMT

I'm guessing that you are using search time field extraction.
If you are using search head clustering behind a router, one search head has the correct props.conf and another does not.

Any time the sourcetype is modified, you must cycle Splunk. First try diff'ing props.conf and/or transforms.conf between the two servers. If they don't match, that's your issue. If they do match, cycle Splunk on the server that's not parsing properly.

Also, for search time field extraction, props.conf must exist under the context of the search app. On the server where the results are different/unexpected, ensure that the correct sourcetype exists, and is in the correct context (.../etc/apps/search/...) eg.

topic same BIND logs parsing different in Getting Data In

same BIND logs parsing different

Re: same BIND logs parsing different