Hi Folks, First time using splunk, i've managed to get my draytek router chucking the logs to splunk.
id like to perform a search so i can create a dashboard panel that shows me the TOP DNS queries, im not sure of the best way to do this, perhaps some one can point me in the right direction and provide me some code if needs be.
I would be really very qreatful for any help i can get.
Below is a log extract showing a dns lookup - raw data from the draytek
Jun 24 16:22:06 192.168.y.x Jun 24 16:20:51 Router: Local User (MAC=AA-BB-CC-DD-EE-FF): 192.168.y.x DNS -> 18.104.22.168 inquire orcart.facebook.com