Splunk Stream - DNS Logs - Splunk Community

Getting Data In

All,

I have enabled Splunk Stream on a single domain controller as a test to monitor the DNS traffic. It's largely went well but I am suprised to find I am not seeing the actually DNS query value. In the CIM I see query=* I also see that in Splunk TA DNS. Any idea why that isn't working on Stream?

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...