Getting Data In

Unbound DNS Resolver Logs

ArmbrusterC
Explorer

```

Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile[.]com. A IN

Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09[.]co[.]uk. AAAA IN
```
Above I have included 2 separate events. Note * I added brackets for sanitization in this post, the real events have no square brackets. These are from a DNS Resolver.
I've been using a splunk app I've modified to handle extraction of fields.
The current stanza in props.conf is:
EXTRACT-queries = info: resolving (?P<query>(?:.[^\.\s]+)*)\.\s(?P<query_type>\S+)
Ive also tried:
EXTRACT-queries = info: resolving (?P<query>[\S?]+)\.\s(?P<query_type>\S+)
Both of these work fine testing outside splunk. But have strange behavior when used in splunk.

This annoyingly is including the ending period in the query field. Which I specifically wrote the regex to exclude.
query = "acceptor.mcafee-mvision-mobile[.]com.", query_type = "A"
query = "ns-1608.awsdns-09[.]co[.]uk.", query_type = "AAAA"

I'm no splunk expert nor am I a regex expert but I don't see how the match for the query group is including the last period after the TLD.
Any help or suggestions would be appreciated. I think ive given enough info but if you need more let me know.

Labels (3)
0 Karma
1 Solution

to4kawa
Ultra Champion
|makeresults
| eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN
Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN"
| multikv noheader=t
| table _raw
| rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?P<query>\S+)\s(?P<query_type>\S+)"

View solution in original post

to4kawa
Ultra Champion
|makeresults
| eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN
Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN"
| multikv noheader=t
| table _raw
| rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?P<query>\S+)\s(?P<query_type>\S+)"

ArmbrusterC
Explorer

Thats smart, I hadn't thought of using eval to feed in data with a search time extraction. Thanks for that piece.

So using this method to test it appears the match is correct. So the problem Im having is likely related to the App changes Ive done

|makeresults
| eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN
Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN
Dec 27 16:00:51 pvlpfSense01 unbound: [15920:1] info: resolving (init part 3): 165.185.in-addr.arpa. DS IN"
| multikv noheader=t
| table _raw
| rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?:\(init part \d\):\s{2})?(?P<query>[\S?]+)\.\s(?P<query_type>\S+)"

 

 The example you gave includes the final "." in the FQDN. I will mark your answer as correct since you gave me the piece I was missing to test the extraction in realtime.
Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...