Filter DNS debug log at index

henocqr — Thu, 02 Feb 2012 11:51:03 GMT

I want to drop resolved DNS requests at index time.

Windows 2008 DNS log format using Splunk 4.3

Can anyone help me with the REGEX to pick up NOERROR from log format:-

02/02/2012 11:19:06 1CB4 PACKET 0000000003C7A6C0 UDP Rcv 10.112.89.5 a3df Q [1001 D NOERROR] PTR .....

I plan to send to null queue using props & tranforms.

Thanks
Ray

Re: Filter DNS debug log at index

MuS — Thu, 02 Feb 2012 13:46:47 GMT

Hi henocqr

your regex to pick up NOERROR would be NOERROR, but I think you want to pick up each event which contains NOERROR and route it to the null queue, right?
then the regex would be .*NOERROR.*

cheers

topic Re: Filter DNS debug log at index in Monitoring Splunk

Filter DNS debug log at index

Re: Filter DNS debug log at index