Getting Data In

Top DNS queries from DNS logs

tevgey23
Explorer

Hello,

I wanted to know what would be the best way to see the top 20 FQDN coming from DNS

To get to the results below I had to run this command

index="MyDNSlog" sourcetype=dns | rex mode=sed "s/\(\d+\)/./g" 

8/15/2012 10:27:11 AM 08E8 PACKET  000000000443D750 UDP Snd 192.168.44.2     0f93 R Q [8085 A DR  NOERROR] A      .google.com.

host=MYDNS Options| sourcetype=dns Options| source=C:\dir\dns444.log Options| timeendpos=22 Options

How can I further extract the domain name in order to view top 20 DNS queries

Thank you

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

If you want the google.com or amazon.com or dummy.domain.here at the end of the event, something like this should do;

...| rex "\s+\.(?<domain>.+)\.$" | top 20 domain

hope this helps,

Kristian

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

If you want the google.com or amazon.com or dummy.domain.here at the end of the event, something like this should do;

...| rex "\s+\.(?<domain>.+)\.$" | top 20 domain

hope this helps,

Kristian

0 Karma

tevgey23
Explorer

Thank you very much. That works

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...