Need help to get the DHCP logs in Splunk tagged and parsed correctly. The data is in the index xyz.
1. The IPv6 DHCP data is being tagged correctly, with sourcetype=dchp. The IPv4 DHCP data is being tagged with sourcetype=xyz:bind:query. Can we get that corrected to dhcp? I believe all of the DHCP servers also provide DNS. All of those log entries appear to have the correct sourcetype xyz:bind:query.
2. The DHCP request type is not being parsed in index=xyz sourcetype=dhcp. I'd like this to be stored in a field. It could be named type, action, or whatever you think is appropriate. Sample values are: DHCP_GrantLease, DHCP_RenewLease, DHCP_RebindLease.
