Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

[USA69]

https://splunkbase.splunk.com/app/2934 is it compatible with Splunk enterprise & ES 10.0.4 even though it's archived. Not seeing the following fields 

in Data Model Network_Resolution Fields:

DNS.src

DNS.src_category

DNS.message

DNS.reply_code

DNS.record_type

DNS.query

[PickleRick]

The addon lists the DNS datamodel as one supported for infoblox:dns sourcetype so I would expect it to work.

Having said that - have you verified that your input side is properly configured? And that the source is properly configured to emit properly formatted events? (I don't have much experience with this particular solution but often add-ons rely on some specific configurations on the source side; or sometimes there is something "in between" that messes up the events so they reach Splunk in a different format than add-on creators assumed).

[USA69]

The add-on does not have inputs.conf configured on the default. And it's sending the logs via syslog-ng. Do I still need to create the inputs.conf on the local folder? And will appreciate if you can very if this is the correct configuration for inputs.conf below

[udp://514]
connection_host = ip
sourcetype = infoblox:syslog
index = infoblox

[PickleRick]

OK. If you're receiving your syslogs through an external component, make sure the resulting combined configuration of the ingesting side doesn't modify the events in a way that they don't match the assumed format. You don't have to define additional input on your Splunk box directly.

Are your events correctly sourcetyped? As far as I remember, the addon does some sourcetype-casting depending on the type of events you're receiving so even though your sourcetype should be configured as infoblox:syslog in your syslog-ng configuration  (or - if you're using intermediate files - your file inputs reading the files must set that sourcetype) but after ingestion the events should be indexed as - in your case - infoblox:dns sourcetype. Does it match your situation?

[USA69]

It was configured through Cribl to send the logs to Splunk. the sourcetype is infoblox:dns

source is infoblox

[PickleRick · Accepted solution]

With that much information can't tell anything more. You have to check whether Cribl does something to your events (we don't know that), whether the events fit the extractions defined in the TA (can use regex101 for that).

[USA69]

Thanks for the update

[livehybrid]

Hi @USA69 

This is a Splunk supported addon, therefore I would recommend raising a support case with these details and you should hopefully get this raised directly to the correct team internally.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.