Splunk Search

Can't extract named fields

hortone
New Member

I am collecting syslogs from the network (UDP 514) and they are all coming in as sourcetype=syslog. I did not see a choice for auto. Because of this, I can't search for sourcetype=named. I tried to manually extract the fields but I keep getting the error "can't extract named fields". I need to be able to monitor the queries. Is there a way to make these events show as DNS queries?

Tags (1)
0 Karma

kenth
Splunk Employee
Splunk Employee

You need to make splunk recognize that it's logs from named and then rewrite the sourcetype. The way you do this is with a combination of props.conf and transforms.conf

transforms.conf

[force_named_sourcetype]
SOURCE_KEY = MetaData::Source
DEST_KEY = MetaData::Sourcetype
REGEX = (named:)
FORMAT = sourcetype::named

props.conf

[source::udp:514]
TRANFORMS-force-named = force_named_sourcetype

Voilá!

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...