How to use Splunk Stream and send DNS analytic logs from DNS server to Splunk?
Splunk is running on Windows Server 2012 and DNS server is also 2012
What I am trying to achieve is detect malicious DNS traffic
There is no proper documentation on this product
Stream data capture configuration
basics Use the Configure Streams UI
inside Splunk App for Stream
(splunkappstream) to configure the
specific network data protocols (such
as http, tcp, dns, pop3, smtp and so
on) that you want the streamfwd binary
Basically you install the TA somewhere, the documentation will state about winpcap been installed (I've only used stream on Linux so you will need to check the requirements).
You point the TA to where you are hosting the stream app, then you use the stream app to remotely configure the TA to forward DNS data.