Hello Splunkers!
I have set up a DNS analytical logging on a windows 2012 R2 server with the following configuration:
[WinEventLog://Microsoft-Windows-DNSServer/Audit]
sourcetype = MSAD:NT6:DNS
disabled = 0
index = test
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
renderXml = false
When I search the _internal logs, I do not see any errors but I get the following logs:
03-08-2021 12:26:25.609 +0200 INFO Metrics - group=per_sourcetype_thruput, series="msad:nt6:dns", kbps=0.029, eps=0.129, kb=0.908, ev=4, avg_age=1.000, max_age=1
However, I do not receive any logs for this sourcetype.
Are there any clues why I cant see these logs?
How are you looking for the data? Does the "test" index exist on your indexers? Have you searched over an expanded time window to allow for incorrect timestamp parsing?
index=test sourcetype=msad:nt6:dns earliest=-1y latest=+1y
How are you looking for the data? Does the "test" index exist on your indexers? Have you searched over an expanded time window to allow for incorrect timestamp parsing?
index=test sourcetype=msad:nt6:dns earliest=-1y latest=+1y
Ok, it seems that the issue is the incorrect timestamp as you mentioned. Thank you!