Splunk Enterprise Security

Using Splunk Stream Aggregation with Network Resolution Data Model

att35
Builder

Hi,

We are using Splunk Stream to get DNS logs into Splunk and it maps seamlessly with the Network Resolution Data model as well. To get cleaner data, I created another DNs stream but this time with some aggregation as shown below. Intent is to get concise summaries of DNS events without overwhelming the Indexers.

DNS_Aggregation.png

 

Now instead of field "query",  data is  coming  as field values(query) which no longer maps to Network Resolution Data Model. DNS.query now reads unknown.

Has anyone come across this issue? Would renaming the field resolve the issue or is there a better way to fix the mapping?

Thanks,

~ Abhi

 

 

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...