same BIND logs parsing different

[bluaces]

Good morning all,

I got two DNS servers, mirrors one of the other, that are sending logs to splunk via Syslog.

Doing some research I found that one of the hosts logs are being properly parsed but the logs for the other ones are not.

properly parsed query

unparsed query

Both systems logs are stored in the same index and use the same sourcetype.

Any help will be really appreciated.

[codebuilder]

I'm guessing that you are using search time field extraction.
If you are using search head clustering behind a router, one search head has the correct props.conf and another does not.

Any time the sourcetype is modified, you must cycle Splunk. First try diff'ing props.conf and/or transforms.conf between the two servers. If they don't match, that's your issue. If they do match, cycle Splunk on the server that's not parsing properly.

Also, for search time field extraction, props.conf must exist under the context of the search app. On the server where the results are different/unexpected, ensure that the correct sourcetype exists, and is in the correct context (.../etc/apps/search/...) eg.