Splunk Enterprise Security

Splunk Add-on for Windows - DNS Not Mapped to CIM?

omri_p
Engager

i have installed the Splunk Add-on for Windows app to monitor DNS logs using the Debugging enabled option on my server.
i am seeing the events ingesting with the proper source type of MSAD:NT6:DNS but they are not tagged as DNS (only with Success and Failure tags)
also under the Tags Tab im not seeing that in the app there is DNS tag option for that app neither under the Sourcetype Tab
it means that the app does not map this source type to the data model.
the app is documented that it supports CIM
please explain

Labels (1)

evinasco
Communicator

did someone fixe this issue? I am also having this error. Any solution?

0 Karma

lznger88_2
Path Finder

I'd would have liked to provided you an answer but I am also having this issue. Did you find a solution?

cbschreiber
Explorer

I'm running across the same basic thing.

I have sourcetype="MSAD:NT6:DNS" and the fields are parsing correctly.

However, 'Network Resolution' Data Model is looking for 3 tags:

network
resolution
dns

And the only thing that is tagging is 'success'.

Is there a param needed in the inputs.conf to get these tags working?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...