Getting Data In

Windows DNS Drop line via nullQueue not working

JeremyHagan
Communicator

I'm trying to drop DNS requests for internal names from our Windows DNS logs. For a guide I am using an answer from this question:
https://answers.splunk.com/answers/35259/best-method-for-pulling-microsoft-dns-logs-with-splunk.html

We have two TLDs I'd like to filter out, for example bob.local and fred.local

I've added the following to my props.conf:

[win_dns]
TRANSFORMS-drop = win_dns_ignorelogs

And the following to my transforms.conf

[win_dns_ignorelogs]
REGEX =(?i)\.*(bob|fred)\.local
DEST_KEY = queue
FORMAT = nullQueue

And restarted Splunk.

One thing to note is that we have a SED command in the props.conf which replaces the standard formatting of the records from something like this:

13/12/2015 9:29:58 AM 0678 PACKET  0000000001FE2D10 TCP Rcv 127.0.0.1       4a3f   Q [0001   D   NOERROR] NS     (8)bob(3)local(0)

To something like this:

13/12/2015 9:29:58 AM 0678 PACKET  0000000001FE2D10 TDP Rcv 127.0.0.1       4a3f   Q [0001   D   NOERROR] NS    bob.local

Via and entry in the props.conf like this:

[source::win_dns]
SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g

When I test the regex in search like this:

sourcetype=win_dns questionName="bob.local" | regex _raw="(?i)\.*(bob|fred)\.local"

It matches the events I am expecting to drop, but the events are still being indexed. Can someone please help me out?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi JeremyHagan,

combine the props.conf into one stanza, because your events will only be parsed once by Splunk. So either do something like this:

[source::win_dns]
SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g
TRANSFORMS-drop = win_dns_ignorelogs

or

[win_dns]
SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g
TRANSFORMS-drop = win_dns_ignorelogs

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi JeremyHagan,

combine the props.conf into one stanza, because your events will only be parsed once by Splunk. So either do something like this:

[source::win_dns]
SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g
TRANSFORMS-drop = win_dns_ignorelogs

or

[win_dns]
SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g
TRANSFORMS-drop = win_dns_ignorelogs

Hope this helps ...

cheers, MuS

JeremyHagan
Communicator

Ahh, that makes sense. I've made the update and scheduled a restart for tomorrow morning. I'll provide more feedback tomorrow.

0 Karma

JeremyHagan
Communicator

I can confirm that this worked. Thanks MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Thanks for the karma, but up voting will not take your karma away 😉 see this https://answers.splunk.com/answers/334246/need-info-about-the-karma-points-system.html for more details

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...