Splunk Add-on for Infoblox: For a single syslog file of DNS logs, which sourcetype should I use?

[nychawk]

Greetings;

I am trying to ingest Infoblox logs received via syslog. Documentation states DNS logs should be sourcetype infoblox:dns , and DHCP as infoblox:dhcp. Both logs are combined, so which sourcetype should I use?

Is it possible (I am not the Infoblox admin) to separate these logs differently through syslog?

[Heff]

Check this as well..

https://answers.splunk.com/answers/105106/splunk-for-infoblox.html

[javiergn · Accepted solution]

Hi,

I haven't used it in production yet but if you look at props and transforms, it's just expecting the following two sourcetypes initially:

[infoblox:port]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
SHOULD_LINEMERGE = false
DATETIME_CONFIG = NONE
TRUNCATE = 0

[infoblox:file]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
MAX_TIMESTAMP_LOOKAHEAD = 20
SHOULD_LINEMERGE = false
TRUNCATE = 0

After that it will look at the data and assign it a sourcetype:

[infoblox_branch_source_type_1]
DEST_KEY = MetaData:Sourcetype
REGEX = \sdhcpd\[
FORMAT = sourcetype::infoblox:dhcp

[infoblox_branch_source_type_2]
DEST_KEY = MetaData:Sourcetype
REGEX = \snamed\[
FORMAT = sourcetype::infoblox:dns

So to answer your question. You should use infoblox:port if this is coming via Syslog or infoblox:file if you are reading it from a file.

Give it a go and let me know if that works.

[nychawk]

Thank you, that did the trick!