All Apps and Add-ons

How to extract and label data from Linux DNS named logs?

reswob4
Builder

So, I have all the syslogs from my DNS named servers going into Splunk and I'm able to parse them. I'm not a DNS server admin, so I don't know the proper terms for each field so I can properly label them when I create the extractions. Can someone point me to a reference? I've been googling around for a few hours and not really found anything useful.

For example:

error (connection refused) resolving '10.10.10.10/PTR/A/AB': 192.168.1.1#53

error - is that the event, the message, the type, the what?
The message in the () is called the description, the event, the issue, the message?
The resolving ..... is the message, the status, the problem, the?
The IP at the end is the client IP or the upstream DNS or the what?
I'm assuming the 53 is the destination port

Or for these zone messages:

zone my.host.com/AB: notify from 10.10.10.10#32145: zone is up to date

my.host.com/AB is what?
notify from 10.10.10.10 is the receiving server? The destination server? Receiving zone? Destination zone?
Is that number the source port?
And the last, is that the status? the message?

I loaded the Splunk App for Unix and Linux, but that doesn't seem to be applying to correct labels. Is there another app I should use?

0 Karma

Richfez
SplunkTrust
SplunkTrust

named is BIND, isn't it?

Have you tried looking at the Splunk for DNS app? It looks like it should do all that you need.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...