Active Directory DNS logs - extract domain name without periods

[daniel_augustyn]

I've been trying to extract domains from AD DNS logs with the following rex and it's not really working well:

[win]
SEDCMD = s/(\d+)/./g

I am still getting leading and trailing periods, for example:

.www.google.com.

The raw logs has parentheses with number of letters in it.
(3)www(6)google(3)com

Any other idea how to do it right?

[gerardo_maya]

Hello Daniel, 

I found that using the command replace you can create a calculated field called dest.

| eval dest = replace(replace(dnsQuery,"\(\d+\)","."),"^\.|\.$","")

On the first replace you eliminate all the number rounded by parenthesis, and on the other replace you eliminate the first and the last period.

So on Cloud you only need to create a calculated field and put the function replace, just like this

replace(replace(dnsQuery,"\(\d+\)","."),"^\.|\.$","")

I hope it helps other Splunkers to solve this issue or other similar. 

[woodcock]

Your question is phrased very poorly so I cannot begin to answer. You say "capture" but then you are actually using SEDMCD which does not "capture", it actually "modifies by replacing". Please clearly restate what you would like, including a COMPLETE example with a fake event and desired outcome mockup.

[dwaddle · Accepted solution]

This is kind-of a non-answer to your question. But, you might find more success using something like the Splunk App for Stream to pick up DNS data. You'll get nice, clean JSON events with requests and responses and no Windows log silliness..

[daniel_augustyn]

Thank you, I would look into it.