How to Monitor Multiple DNS requests which are not resolved by DNS server from a particular source using SPL

[dhananjay]

Conditons to create query:

1) Query should not contain any eventcode

2) Query must be build from DNS data model

[ITWhisperer]

This is a bit vague - what events do you have (please share some examples)? how often do you want to check? over what time period? which source are you interested in? are you looking for differences in resolutions or just the number of requests resolved?

[dhananjay]

I have corrected my previous question so please check it.

[ITWhisperer]

Thanks - hopefully someone will know what the DNS Data Model looks like and what events are available from it, but it is beyond my ken.