https://community.splunk.com/t5/Getting-Data-In/Monitor-Or-MonitorNoHandle/m-p/481944#M82604 <P>Hi,<BR /> If one wants to import DNS query log on windows server,<BR /> Which is appropriate to use..? Monitor or MonitorNoHandle stanza.</P> Tue, 17 Sep 2019 05:58:01 GMT nandhini_amir 2019-09-17T05:58:01Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Or-MonitorNoHandle/m-p/481944#M82604 <P>Hi,<BR /> If one wants to import DNS query log on windows server,<BR /> Which is appropriate to use..? Monitor or MonitorNoHandle stanza.</P> Tue, 17 Sep 2019 05:58:01 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Or-MonitorNoHandle/m-p/481944#M82604 nandhini_amir 2019-09-17T05:58:01Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Or-MonitorNoHandle/m-p/481945#M82605 <P>I'd use stream, actually, which can read them off the wire on the DNS. It's better and gets all the bad actors making broken requests that Windows throws away.</P> <P>But to your question specifically - MonitorNoHandle seems perfect for this. Have you tried it? Does it do what you want? There's a list of reasons to use and to not use this in the <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Monitorfilesanddirectories">docs for it</A>. See especially the bottom - and how it won't read existing file contents and stuff.</P> Wed, 25 Sep 2019 01:07:53 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Or-MonitorNoHandle/m-p/481945#M82605 Richfez 2019-09-25T01:07:53Z