Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Hi All. We have Universal Forwarder 7.0.2 install...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All
Greetings.
We have DNS server installed on Windows server 2016. We are able to monitor logs like wineventlog: security, Application etc.
We have also enabled DNS logs and we are getting logs in Analytical.etl location %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-DNSServer%4Analytical.etl.
But it seems that Splunk could not read ETL file. Please help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your Answers. We currently enabled debug logging as Analytical logs was not readable by Splunk. We are currently monitoring the resource utilization of DNS server, if it increases considerably, we again need to think of Analytical logs monitoring.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your Answers. We currently enabled debug logging as Analytical logs was not readable by Splunk. We are currently monitoring the resource utilization of DNS server, if it increases considerably, we again need to think of Analytical logs monitoring.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We had the same issue (and a few others improvements we wanted with that Add On) so we ended up bundling all of our fixes here:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk can´t read binary files.
In this post is a suggestion how to get around this though https://answers.splunk.com/answers/64981/monitor-windows-trace-files.html
New Year, New Changes for Splunk Certifications
Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!
[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events
