Monitoring Splunk

Filter DNS debug log at index

henocqr
New Member

Hi

I want to drop resolved DNS requests at index time.

Windows 2008 DNS log format using Splunk 4.3

Can anyone help me with the REGEX to pick up NOERROR from log format:-

02/02/2012 11:19:06 1CB4 PACKET 0000000003C7A6C0 UDP Rcv 10.112.89.5 a3df Q [1001 D NOERROR] PTR .....

I plan to send to null queue using props & tranforms.

Thanks
Ray

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi henocqr

your regex to pick up NOERROR would be NOERROR, but I think you want to pick up each event which contains NOERROR and route it to the null queue, right?
then the regex would be .*NOERROR.*

cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...