topic Re: Unbound DNS Resolver Logs in Getting Data In

Unbound DNS Resolver Logs

ArmbrusterC — Sun, 27 Dec 2020 07:41:54 GMT

```

Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile[.]com. A IN

Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09[.]co[.]uk. AAAA IN

```
Above I have included 2 separate events. Note * I added brackets for sanitization in this post, the real events have no square brackets. These are from a DNS Resolver.
I've been using a splunk app I've modified to handle extraction of fields.
The current stanza in props.conf is:
EXTRACT-queries = info: resolving (?P<query>(?:.[^\.\s]+)*)\.\s(?P<query_type>\S+)

Ive also tried:

EXTRACT-queries = info: resolving (?P<query>[\S?]+)\.\s(?P<query_type>\S+)

Both of these work fine testing outside splunk. But have strange behavior when used in splunk.

This annoyingly is including the ending period in the query field. Which I specifically wrote the regex to exclude.
query = "acceptor.mcafee-mvision-mobile[.]com.", query_type = "A"
query = "ns-1608.awsdns-09[.]co[.]uk.", query_type = "AAAA"

I'm no splunk expert nor am I a regex expert but I don't see how the match for the query group is including the last period after the TLD.
Any help or suggestions would be appreciated. I think ive given enough info but if you need more let me know.

Re: Unbound DNS Resolver Logs

to4kawa — Sun, 27 Dec 2020 09:11:03 GMT

|makeresults | eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN" | multikv noheader=t | table _raw | rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?P<query>\S+)\s(?P<query_type>\S+)"

Re: Unbound DNS Resolver Logs

ArmbrusterC — Sun, 27 Dec 2020 21:11:30 GMT

Thats smart, I hadn't thought of using eval to feed in data with a search time extraction. Thanks for that piece.

So using this method to test it appears the match is correct. So the problem Im having is likely related to the App changes Ive done

|makeresults | eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN Dec 27 16:00:51 pvlpfSense01 unbound: [15920:1] info: resolving (init part 3): 165.185.in-addr.arpa. DS IN" | multikv noheader=t | table _raw | rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?:\(init part \d\):\s{2})?(?P<query>[\S?]+)\.\s(?P<query_type>\S+)"

The example you gave includes the final "." in the FQDN. I will mark your answer as correct since you gave me the piece I was missing to test the extraction in realtime.
Thanks!