All Apps and Add-ons

How can I get a minimum Splunk Stream setup going for DNS?



I am looking at the splunkstream docs here and there is a lot to get this doing. Really all I need at this point in time it to capture the DNS traffic off 10 Windows DNS servers.

I am guessing I can just drop Splunk_TA_stream on the Windows servers which have UFs installs and enable inputs.conf for DNS traffic, right? How would I go about that? Docs seem to assume I am using my Search head cluster as some sort of command and control center. I don't think I can get away with that at this time. Just need the DNS sniffing of the sever NIC.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...