All Apps and Add-ons

Pi-hole DNS App for Splunk: Why are dashboards not populating?

Splunk Employee
Splunk Employee

I have configured the Pi Hole TA, App and CIM and when I open the dashboards it is empty with No Results Found.

I can run this search and it shows the count in the thousands:
| tstats local=f summariesonly=t allow_old_summaries=t count from datamodel=Network_Resolution.DNS

When I run sourcetype=pihole, events come back, but no fields are listed.
What did I do wrong?


Look here:

Create a new file: /etc/dnsmasq.d/02-pihole-splunk.conf.
Add log-queries=extra to the file. save and close the file
Restart pi-hole with pihole restartdns

I had to do that for the extractions to begin working correctly as well.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>