How to create a DNS regex for our sample DNS logs to make them more meaningful?

[jackywsy]

HI Experts,

I am a fresh guy in SPLUNK Searching. Recently, my team leader needed us to create a DNS regex and make the domain name more meaningful. I thought you guys have more experience at this area and know what our leader needs. Please help or paste any useful links here. :- )

6/30/2015 7:16:20 PM 0B4C PACKET  000020C986D845B0 UDP Rcv 10.10.7.5       d300   Q [0001   D   NOERROR] A      (13)mail(8)google(3)com(0)----------mail.google.com
6/30/2015 7:16:20 PM 0B4C PACKET  001000C986D835B0 UDP Rcv 10.10.7.5       d300   Q [0001   D   NOERROR] A      (3)news8)baidu(3)com(0)-----------news.baidu.com

Thanks so much in advance!

[jawaharas]

1. Install the Splunk app - Splunk Add-on for Microsoft Windows DNS

2. Add below configuration in props.conf to get domain name in human readable format.

   [MSAD:NT6:DNS]
   EXTRACT-question1 = ] (?\w+)\s+(?.)
   EXTRACT-question2 = ] (?[^\s])$
   EVAL-domain = trim(replace(questionname, "(([\d]+))", "."),".")

[miteshvohra]

There are handful number of apps which can help you with field extractions. Have a look at this list and pick what meets your requirement or is the closest.

Mitesh.

[jackywsy]

Thanks for your request ,Mitesh.

I clearly know how to create the field extractions. Is this same like that ?? Do you have methods to manually to add this DNS Domain Name to somewhere that I may need .Then make it happen. Is this possible?

Thanks.

[jackywsy]

Please help