Can anyone confirm if DNS debug logging needs to be enabled manually before this will work correctly?
From the TA-DNS inputs.conf
[monitor://C:\Windows\System32\Dns\dns.log] sourcetype=MSAD:NT6:DNS disabled=false index=msad
Thank you!
Yes, you need to enable DNS debug logging. See http://technet.microsoft.com/en-us/library/cc759581(v=ws.10).aspx for details on how to do this.
