Active Directory DNS debug logs extract domain name

[splunkranger]

props.conf
[win_dns]
SEDCMD-win_dns = s/(\d+)/./g
SEDCMD-domainname = s/(\(\d\))/./g
EXTRACT-dns_name = (?i)] \w+\s+(?P(.+))

Example of dns_name

.hostname.domainname.org.

Can you help advise on how to remove the leading and trailing periods on dns_name ?

Thank you

[jawaharas]

Below configuration in props.conf will fetch domain name.

[MSAD:NT6:DNS]
EXTRACT-question1 = \] (?<questiontype>\w+)\s+(?<questionname>.*)
EXTRACT-question2 = \] (?<questionname>[^\s]*)$
EVAL-domain = trim(replace(questionname, "(\([\d]+\))", "."),".")

[splunkranger]

Thank you

The best example I have is below, the field has a leading and trailing period. I would like remove. I can do it at search time using replace however if it can be done at index time it would be better.

.hostname.domainname.org.

[richgalloway]

'EXTRACT-dns_name = (?i)] w+s+\.(?P<dns_name>(.+))' should get rid of the leading period. You should be able to get rid of both of them using 'EXTRACT-dns_name = (?i)] w+s+\.(?P<dns_name>(.+))\.<foo>' where is the delimiter marking the end of dns_name (space or comma, for example). Seeing an example event would help improve this answer.

[richgalloway]

It would be useful to see the raw event data that is being indexed, especially the parts immediately before and after the domain name.

[pjohnson1]

Here you go Rich...

09/08/2015 23:58:56 1C78 PACKET  000000000A12C7D0 UDP Rcv 111.222.333.444   05da   Q [0001   D   NOERROR] A      .www.bluecoat.com.

[daniel_augustyn]

Were you able to figure this out?

[splunkranger]

Thank you

The best example I have is below, the field has a leading and trailing period. I would like remove. I can do it at search time using replace however if it can be done at index time it would be better.

.hostname.domainname.org.