Cannot find MSAD:NT6:DNS data

[andresito123]

Hello Splunkers!

I have set up a DNS analytical logging on a windows 2012 R2 server with the following configuration:

[WinEventLog://Microsoft-Windows-DNSServer/Audit]
sourcetype = MSAD:NT6:DNS
disabled = 0
index = test
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
renderXml = false

When I search the _internal logs, I do not see any errors but I get the following logs:

03-08-2021 12:26:25.609 +0200 INFO  Metrics - group=per_sourcetype_thruput, series="msad:nt6:dns", kbps=0.029, eps=0.129, kb=0.908, ev=4, avg_age=1.000, max_age=1

However, I do not receive any logs for this sourcetype.

Are there any clues why I cant see these logs?

[richgalloway · Accepted solution]

How are you looking for the data?  Does the "test" index exist on your indexers?  Have you searched over an expanded time window to allow for incorrect timestamp parsing?

index=test sourcetype=msad:nt6:dns earliest=-1y latest=+1y

[andresito123]

Ok, it seems that the issue is the incorrect timestamp as you mentioned. Thank you!