Getting Data In

Best way to nullQueue DNS logs by source

adalbor
Builder

Hey All,

Was just curious if there was a more efficient way of dropping DNS events by the actual query source rather than what I have below.

[MSAD:NT6:DNS]
TRANSFORMS-dropdns=dropdns

[dropdns]
REGEX=.*IPOFSOURCE.*
DEST_KEY=queue
FORMAT=nullQueue
0 Karma
1 Solution

adalbor
Builder

I ended up resolving the issue I had. The UF in question that wasn't working was going through a HF rather than straight to my IDX's

Applied the following to the HF's and IDX's and it started dropping the matching events.

Support also recommended I use source rather than sourcetype as it was more reliable.

Props.conf
[source::c:\DNSLOGS\dns.log]
TRANSFORMS-dropdns=dropdns1,dropdns2

Transforms.conf
[dropdns1]
REGEX = .1.1.1.1.
DEST_KEY = queue
FORMAT = nullQueue

[dropdns2]
REGEX = .2.2.2.2.
DEST_KEY = queue
FORMAT = nullQueue

View solution in original post

0 Karma

adalbor
Builder

I ended up resolving the issue I had. The UF in question that wasn't working was going through a HF rather than straight to my IDX's

Applied the following to the HF's and IDX's and it started dropping the matching events.

Support also recommended I use source rather than sourcetype as it was more reliable.

Props.conf
[source::c:\DNSLOGS\dns.log]
TRANSFORMS-dropdns=dropdns1,dropdns2

Transforms.conf
[dropdns1]
REGEX = .1.1.1.1.
DEST_KEY = queue
FORMAT = nullQueue

[dropdns2]
REGEX = .2.2.2.2.
DEST_KEY = queue
FORMAT = nullQueue

0 Karma

adalbor
Builder

I modified it to include another IP but it doesnt appear to be working. Have this on all of my IDX's.
Any suggestions?

[MSAD:NT6:DNS]
 TRANSFORMS-dropdns = dropdns

 [dropdns]
 REGEX=.*1.1.1.1.*|.*2.2.2.2.*
 DEST_KEY=queue
 FORMAT=nullQueue
0 Karma

anmolpatel
Builder

@adalbor need two pieces of info:
1) what is the deployment architecture?
2) Did you reload the indexers to get the new props and transforms config ?

0 Karma

adalbor
Builder

1) Clustered indexers and UF's on the servers with the DNS logs
2) Yes after every change

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...