Splunk App for Enterprise Security: Network Resolution (DNS) datamodel not populating

[DmitryTchersak]

The dns datamodel is not populating because out of the box neither ES or the Windows Infrastructure app have the tag constraints defined. The datamodel is looking for the following three tags "tag=network tag=dns tag=resolution" for windows debug dns requests these tags are not defined anywhere.

Is there another app that is required to create these tags? or are there eventtypes that exist that can be mapped for example to the resolution tag?

[mreynov_splunk]

DNS data model is actually used in many add-ons.
For windows add-on this is currently a known issue and under active development.

[aholzel]

As far as I have figured it out the DNS datamodel is only for DNS data provided via the splunk stream app.