Filter DNS debug log at index

[henocqr]

Hi

I want to drop resolved DNS requests at index time.

Windows 2008 DNS log format using Splunk 4.3

Can anyone help me with the REGEX to pick up NOERROR from log format:-

02/02/2012 11:19:06 1CB4 PACKET 0000000003C7A6C0 UDP Rcv 10.112.89.5 a3df Q [1001 D NOERROR] PTR .....

I plan to send to null queue using props & tranforms.

Thanks
Ray

[MuS]

Hi henocqr

your regex to pick up NOERROR would be NOERROR, but I think you want to pick up each event which contains NOERROR and route it to the null queue, right?
then the regex would be .*NOERROR.*

cheers