I would like to forward DNS events from my DNS server with a UF that is monitoring the dns.log debug output. i am already forwarding WIndows Events under sourcetype=wineventlog based on https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/SourcetypesandCIMdatamodelinfo DNS Logs would also need to be under the same sourcetype name in order for the add on https://splunkbase.splunk.com/app/742/ to normalize the events i do not wish to use the same sourcetype name for the win events and for the DNS what am i missing?
If you want to use different sourcetype for DNS logs and want to utilize 'Splunk Add-on for Windows' for data normalization as per CIM, you can clone the configurations of 'wineventlog' sourcetype in 'props.conf' and rename the sourcetype to 'dns'.
Reference: https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration
@omri_p Can you upvote and accept the answer if it's helped you? Thanks.
