I am collecting syslogs from the network (UDP 514) and they are all coming in as sourcetype=syslog. I did not see a choice for auto. Because of this, I can't search for sourcetype=named. I tried to manually extract the fields but I keep getting the error "can't extract named fields". I need to be able to monitor the queries. Is there a way to make these events show as DNS queries?