How to use Splunk Stream to send DNS analytic logs from DNS server to Splunk?

[tonyxavierj]

How to use Splunk Stream and send DNS analytic logs from DNS server to Splunk?
Splunk is running on Windows Server 2012 and DNS server is also 2012
What I am trying to achieve is detect malicious DNS traffic
There is no proper documentation on this product

[gjanders · Accepted solution]

Perhaps you can send the documentation team some constructive feedback if you cannot find what you want?

Splunk Stream™ Installation and Configuration Manual , DNS is a supported protocol, if you download the PDF and read through it:

Stream data capture configuration
basics Use the Configure Streams UI
inside Splunk App for Stream
(splunk_app_stream) to configure the
specific network data protocols (such
as http, tcp, dns, pop3, smtp and so
on) that you want the streamfwd binary
to capture

Basically you install the TA somewhere, the documentation will state about winpcap been installed (I've only used stream on Linux so you will need to check the requirements).
You point the TA to where you are hosting the stream app, then you use the stream app to remotely configure the TA to forward DNS data.