Can't extract named fields

[hortone]

I am collecting syslogs from the network (UDP 514) and they are all coming in as sourcetype=syslog. I did not see a choice for auto. Because of this, I can't search for sourcetype=named. I tried to manually extract the fields but I keep getting the error "can't extract named fields". I need to be able to monitor the queries. Is there a way to make these events show as DNS queries?

[kenth]

You need to make splunk recognize that it's logs from named and then rewrite the sourcetype. The way you do this is with a combination of props.conf and transforms.conf

transforms.conf

[force_named_sourcetype]
SOURCE_KEY = MetaData::Source
DEST_KEY = MetaData::Sourcetype
REGEX = (named:)
FORMAT = sourcetype::named

props.conf

[source::udp:514]
TRANFORMS-force-named = force_named_sourcetype

Voilá!