Splunk Search

Can't extract named fields

New Member

I am collecting syslogs from the network (UDP 514) and they are all coming in as sourcetype=syslog. I did not see a choice for auto. Because of this, I can't search for sourcetype=named. I tried to manually extract the fields but I keep getting the error "can't extract named fields". I need to be able to monitor the queries. Is there a way to make these events show as DNS queries?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You need to make splunk recognize that it's logs from named and then rewrite the sourcetype. The way you do this is with a combination of props.conf and transforms.conf

transforms.conf

[force_named_sourcetype]
SOURCE_KEY = MetaData::Source
DEST_KEY = MetaData::Sourcetype
REGEX = (named:)
FORMAT = sourcetype::named

props.conf

[source::udp:514]
TRANFORMS-force-named = force_named_sourcetype

Voilá!

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!