Why doesn't the Splunk Add-on for Microsoft Windows DNS populate the Network Resolution data model?

[ejwade]

I'm not seeing the Network Resolution/DNS datamodel/dataset populated from the Splunk Add-on for Microsoft Windows DNS. The add-on was installed per the documentation on all Windows DNS servers.

Couple notes:

• The MSAD:NT6:DNS sourcetype had one too many forward slashes. I changed the stanza from [MonitorNoHandle:///C:\TEMP...] to [MonitorNoHandle://C:\TEMP...] and then logs were getting ingested.
• The add-on wasn't extracting anything when it was installed on ONLY DNS servers (per documentation). I had to install on indexers and search heads to get search time extraction. I recommend the documentation get updated to reflect this.
• We are running Splunk Enterprise Security. I whitelisted "msad" in the CIM Setup to ensure the data model was looking at this index.

Thank you.
Ed

[guarisma · Accepted solution]

Unfortunately this Add-on doesn't match the CIM for Network Resolution DNS.
It's really strange that Splunk wouldn't make all the extractions and calculations match sowe could accelerate this data and use it with Splunk ES or Splunk Security Essentials.
You can try creating aliases and tagging the events to match the CIM Data model, but I think it should have been done out of the box by Splunk.

[MonkeyK]

This is actually not very easy to do with the default Windows DNS logging.  Firstly, to populate the Network Resolution, one would need to correlate request and response records.  But beyond that, Microsoft logs DNS at a debug level and logs are multiple lines long and very difficult to parse.

Splunk does do the aggregation and parsing in the Stream app, but even that does not handle the datamodel mapping.  A shame really, because it is not really clear how the Network Resolution model is supposed to be used with a number of DNS return types.