How to configure Windows DNS Analytical and Diagnostic Logs add-on to get the logs in Splunk?

[cristibe]

Hi,

I'm already running the Windows 2012 R2 setup, but how can I get the logs in Splunk? Also, can I use DNS Analytics as a graphical interface?

Thanks.

[Richfez]

The latter answer is 'Yes, I believe so.' I looked at that app and it does appear to be a graphical look at a lot of your DNS stuff.

For the former, you will probably want the Splunk Add-on for Windows DNS.

While it may be more work, I had set up the Splunk App for Windows Infrastructure and found it very useful. It contains the DNS add-on mentioned above. And, just a note that while it's more work to get set up, nothing in that setup is particularly hard there's just a fair amount to it. It is well documented which always makes it easier!