topic Re: Ingesting DNS Server logs in Splunk Enterprise Security

Ingesting DNS Server logs

omri_p — Tue, 16 Jul 2019 20:39:09 GMT

I would like to forward DNS events from my DNS server with a UF that is monitoring the dns.log debug output.
i am already forwarding WIndows Events under sourcetype=wineventlog
based on https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/SourcetypesandCIMdatamodelinfo
DNS Logs would also need to be under the same sourcetype name in order for the add on https://splunkbase.splunk.com/app/742/

to normalize the events
i do not wish to use the same sourcetype name for the win events and for the DNS
what am i missing?

Re: Ingesting DNS Server logs

jawaharas — Sat, 03 Aug 2019 18:04:10 GMT

If you want to use different sourcetype for DNS logs and want to utilize 'Splunk Add-on for Windows' for data normalization as per CIM, you can clone the configurations of 'wineventlog' sourcetype in 'props.conf' and rename the sourcetype to 'dns'.

Reference:
https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration

Re: Ingesting DNS Server logs

jawaharas — Wed, 07 Aug 2019 05:10:31 GMT

@omri_p
Can you upvote and accept the answer if it's helped you? Thanks.