Getting Data In
Highlighted

same BIND logs parsing different

New Member

Good morning all,

I got two DNS servers, mirrors one of the other, that are sending logs to splunk via Syslog.

Doing some research I found that one of the hosts logs are being properly parsed but the logs for the other ones are not.

properly parsed query
alt text

unparsed query
alt text

Both systems logs are stored in the same index and use the same sourcetype.

Any help will be really appreciated.

0 Karma
Highlighted

Re: same BIND logs parsing different

Motivator

I'm guessing that you are using search time field extraction.
If you are using search head clustering behind a router, one search head has the correct props.conf and another does not.

Any time the sourcetype is modified, you must cycle Splunk. First try diff'ing props.conf and/or transforms.conf between the two servers. If they don't match, that's your issue. If they do match, cycle Splunk on the server that's not parsing properly.

Also, for search time field extraction, props.conf must exist under the context of the search app. On the server where the results are different/unexpected, ensure that the correct sourcetype exists, and is in the correct context (.../etc/apps/search/...) eg.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.