All Apps and Add-ons

Splunk Add-on for Infoblox: For a single syslog file of DNS logs, which sourcetype should I use?

nychawk
Communicator

Greetings;

I am trying to ingest Infoblox logs received via syslog. Documentation states DNS logs should be sourcetype infoblox:dns , and DHCP as infoblox:dhcp. Both logs are combined, so which sourcetype should I use?

Is it possible (I am not the Infoblox admin) to separate these logs differently through syslog?

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Hi,

I haven't used it in production yet but if you look at props and transforms, it's just expecting the following two sourcetypes initially:

[infoblox:port]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
SHOULD_LINEMERGE = false
DATETIME_CONFIG = NONE
TRUNCATE = 0

[infoblox:file]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
MAX_TIMESTAMP_LOOKAHEAD = 20
SHOULD_LINEMERGE = false
TRUNCATE = 0

After that it will look at the data and assign it a sourcetype:

[infoblox_branch_source_type_1]
DEST_KEY = MetaData:Sourcetype
REGEX = \sdhcpd\[
FORMAT = sourcetype::infoblox:dhcp

[infoblox_branch_source_type_2]
DEST_KEY = MetaData:Sourcetype
REGEX = \snamed\[
FORMAT = sourcetype::infoblox:dns

So to answer your question. You should use infoblox:port if this is coming via Syslog or infoblox:file if you are reading it from a file.

Give it a go and let me know if that works.

View solution in original post

bheffernan_splu
Splunk Employee
Splunk Employee
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

I haven't used it in production yet but if you look at props and transforms, it's just expecting the following two sourcetypes initially:

[infoblox:port]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
SHOULD_LINEMERGE = false
DATETIME_CONFIG = NONE
TRUNCATE = 0

[infoblox:file]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
MAX_TIMESTAMP_LOOKAHEAD = 20
SHOULD_LINEMERGE = false
TRUNCATE = 0

After that it will look at the data and assign it a sourcetype:

[infoblox_branch_source_type_1]
DEST_KEY = MetaData:Sourcetype
REGEX = \sdhcpd\[
FORMAT = sourcetype::infoblox:dhcp

[infoblox_branch_source_type_2]
DEST_KEY = MetaData:Sourcetype
REGEX = \snamed\[
FORMAT = sourcetype::infoblox:dns

So to answer your question. You should use infoblox:port if this is coming via Syslog or infoblox:file if you are reading it from a file.

Give it a go and let me know if that works.

nychawk
Communicator

Thank you, that did the trick!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...