All Apps and Add-ons
Highlighted

Splunk Add-on for Infoblox: For a single syslog file of DNS logs, which sourcetype should I use?

Communicator

Greetings;

I am trying to ingest Infoblox logs received via syslog. Documentation states DNS logs should be sourcetype infoblox:dns , and DHCP as infoblox:dhcp. Both logs are combined, so which sourcetype should I use?

Is it possible (I am not the Infoblox admin) to separate these logs differently through syslog?

0 Karma
Highlighted

Re: Splunk Add-on for Infoblox: For a single syslog file of DNS logs, which sourcetype should I use?

SplunkTrust
SplunkTrust

Hi,

I haven't used it in production yet but if you look at props and transforms, it's just expecting the following two sourcetypes initially:

[infoblox:port]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
SHOULD_LINEMERGE = false
DATETIME_CONFIG = NONE
TRUNCATE = 0

[infoblox:file]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
MAX_TIMESTAMP_LOOKAHEAD = 20
SHOULD_LINEMERGE = false
TRUNCATE = 0

After that it will look at the data and assign it a sourcetype:

[infoblox_branch_source_type_1]
DEST_KEY = MetaData:Sourcetype
REGEX = \sdhcpd\[
FORMAT = sourcetype::infoblox:dhcp

[infoblox_branch_source_type_2]
DEST_KEY = MetaData:Sourcetype
REGEX = \snamed\[
FORMAT = sourcetype::infoblox:dns

So to answer your question. You should use infoblox:port if this is coming via Syslog or infoblox:file if you are reading it from a file.

Give it a go and let me know if that works.

View solution in original post

Highlighted

Re: Splunk Add-on for Infoblox: For a single syslog file of DNS logs, which sourcetype should I use?

Communicator

Thank you, that did the trick!

0 Karma
Highlighted

Re: Splunk Add-on for Infoblox: For a single syslog file of DNS logs, which sourcetype should I use?

Splunk Employee
Splunk Employee
0 Karma