https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-you-help-me-a-problem-I-m-having-with-BRO-s-DNS-logs-and/m-p/459753#M6588 <P>The Detect Long DNS TXT Record Response does not show anything:</P> <PRE><CODE>| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.message_type=response AND DNS.record_type=TXT by DNS.src DNS.dest DNS.answer DNS.record_type | `drop_dm_object_name("DNS")` | eval anslen=len(answer) | search anslen&gt;100 | `ctime(firstTime)` | `ctime(lastTime)` | rename src as "Source IP", dest as "Destination IP", answer as "DNS Answer" anslen as "Answer Length" record_type as "DNS Record Type" firstTime as "First Time" lastTime as "Last Time" count as Count | table "Source IP" "Destination IP" "DNS Answer" "DNS Record Type" "Answer Length" Count "First Time" "Last Time" </CODE></PRE> <P>Seems like all the Network_Resolution datamodel message_type and answers are unknown:</P> <PRE><CODE>answer record_type message_type count unknown TXT unknown 44058 unknown TXT unknown 25818 unknown TXT unknown 22868 unknown TXT unknown 17916 unknown TXT unknown 16092 unknown TXT unknown 16087 unknown TXT unknown 8159 </CODE></PRE> <P>I cut out the src and dest, but as you can see I would get nothing since all the message_type's are unknown and the search is looking for responses. I think every bro DNS log is both a query and a response if the DNS server responds to the query.</P> <P>Do I need to do something special to get the message type of response and the data in the answers? I know that there is data in the answers field for the index=bro sourcetype=bro_dns:</P> <PRE><CODE>_time query qtype_name answers rcode_name tag vendor 28:53.2 10.231.36.73.imwyyj2pluwatbkhz2yqgkzte3fhckp.r.mail-abuse.com TXT TXT 143 Mail from 73.36.231.10 blocked using Trend Micro Email Reputation database. Please see &lt;http://www.mail-abuse.com/cgi-bin/lookup?\\73.36.231.10&gt; NOERROR dns,network,resolution Bro </CODE></PRE> <P>Anyone else using Bro to get DNS into Splunk?</P> <P>Thank you,<BR /> Brian</P> Tue, 29 Sep 2020 21:54:13 GMT bkirk 2020-09-29T21:54:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-you-help-me-a-problem-I-m-having-with-BRO-s-DNS-logs-and/m-p/459753#M6588 <P>The Detect Long DNS TXT Record Response does not show anything:</P> <PRE><CODE>| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.message_type=response AND DNS.record_type=TXT by DNS.src DNS.dest DNS.answer DNS.record_type | `drop_dm_object_name("DNS")` | eval anslen=len(answer) | search anslen&gt;100 | `ctime(firstTime)` | `ctime(lastTime)` | rename src as "Source IP", dest as "Destination IP", answer as "DNS Answer" anslen as "Answer Length" record_type as "DNS Record Type" firstTime as "First Time" lastTime as "Last Time" count as Count | table "Source IP" "Destination IP" "DNS Answer" "DNS Record Type" "Answer Length" Count "First Time" "Last Time" </CODE></PRE> <P>Seems like all the Network_Resolution datamodel message_type and answers are unknown:</P> <PRE><CODE>answer record_type message_type count unknown TXT unknown 44058 unknown TXT unknown 25818 unknown TXT unknown 22868 unknown TXT unknown 17916 unknown TXT unknown 16092 unknown TXT unknown 16087 unknown TXT unknown 8159 </CODE></PRE> <P>I cut out the src and dest, but as you can see I would get nothing since all the message_type's are unknown and the search is looking for responses. I think every bro DNS log is both a query and a response if the DNS server responds to the query.</P> <P>Do I need to do something special to get the message type of response and the data in the answers? I know that there is data in the answers field for the index=bro sourcetype=bro_dns:</P> <PRE><CODE>_time query qtype_name answers rcode_name tag vendor 28:53.2 10.231.36.73.imwyyj2pluwatbkhz2yqgkzte3fhckp.r.mail-abuse.com TXT TXT 143 Mail from 73.36.231.10 blocked using Trend Micro Email Reputation database. Please see &lt;http://www.mail-abuse.com/cgi-bin/lookup?\\73.36.231.10&gt; NOERROR dns,network,resolution Bro </CODE></PRE> <P>Anyone else using Bro to get DNS into Splunk?</P> <P>Thank you,<BR /> Brian</P> Tue, 29 Sep 2020 21:54:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-you-help-me-a-problem-I-m-having-with-BRO-s-DNS-logs-and/m-p/459753#M6588 bkirk 2020-09-29T21:54:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-you-help-me-a-problem-I-m-having-with-BRO-s-DNS-logs-and/m-p/459754#M6589 <P>I found my own answer!</P> <P><A href="https://answers.splunk.com/answers/683453/how-do-i-create-a-multivalue-field-with-an-eval-fu.html">https://answers.splunk.com/answers/683453/how-do-i-create-a-multivalue-field-with-an-eval-fu.html</A></P> Wed, 07 Nov 2018 14:32:26 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-you-help-me-a-problem-I-m-having-with-BRO-s-DNS-logs-and/m-p/459754#M6589 bkirk 2018-11-07T14:32:26Z