Hi all - I'm working to do a lot of cleanup in Splunk ES to cut down on some of the noise. The one area I'm having a ton of excess noise come in is from Excessive DNS Queries. I'm wondering if there is a way to create a "whitelist" of host names where I can filter hostnames that I know are valid and heavily used in our organization - things like office365.com and business related services that are heavily used from being counted towards DNS activity? We're spending alot of time reviewing DNS logs and 99.9% of the time the queries are valid business case uses and not security related. ... View more