Splunk Enterprise Security

Infoblox CIM unknown fields

mmoermans
Path Finder

Hi there,

In order to make certain dashboards fill up in Enterprise Security we need to have dns.message_type show up yet for all events these are marked as "unknown". What's going wrong? The events do have "query" or "response" in them and the field extractions are working fine.

Kind regards,

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>