Getting Data In

SEDCMD help with Windows DNS logs

chemc
Engager

I am trying to use the SEDCMD when indexing Windows DNS logs as described in this solution:
http://splunk-base.splunk.com/answers/4546/field-extraction-regex-fu-help In a nutshell the Windows DNS logs have the domain name being queried in this format: (6)images(6)google(3)com(0) and I need them in this format images.google.com

I added these items to my props.conf in /opt/splunk/etc/system/local:

[source::/home/dnsuser/Downloads/dns1.log]
sourcetype = windns

[windns]
SEDCMD-domainname = s/(\(\d\))/./g

Then I restarted Splunk, created a new index called DNS and a new data input for the file /home/dnsuser/Downloads/dns1.log. In the data input I manually specified windns as the source type. The data is in there and my field extractions specified in transforms.conf are working fine as I can see them by specifying either index=dns or sourcetype=windns.

The domain name is extracted to a field called dns_query. When I view that field in the search results the domain name has not been modified by the SEDCMD. I know the syntax of the SEDCMD is correct because I can use it this way and the domain names are in the proper format:

index=dns | rex "((?(\w+((\d))){1,}?)$)" | rex mode=sed field=dns_query "s/(\(\d\))/./g"

Any help would be appreciated.

landen99
Motivator
SEDCMD-domainname = s/(\(\d+\))/./g

You had an extra "\" and needed an extra "+"

0 Karma

the_wolverine
Champion

If you're using a LightForwarder or Universal Forwarder the SEDCMD configuration needs to exist on the indexer(s) which actually performs the parsing work.

0 Karma

ageld
Path Finder

I am having the same issue. On the Universal forwarder (Windows host) I have configured the following in $SPLUNK_HOME/etc/system/local/props.conf:

[sourcetype::DNSSrvLog]
SEDCMD-dns_name = s/((\(\d+\))/./g

and logs appeared not changed on the indexer

I tried different REGEXes. The one above. The ones below:

s/(\(\d+\))/./g

s/(\(\d+\))/./g

s/\(\d+\)/./g

s/(\d+)/./g

None of that worked. Any assistance will be appreciated.

0 Karma

landen99
Motivator

SEDCMD doesn't work on the UF

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...