The Detect Long DNS TXT Record Response does not show anything: | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.message_type=response AND DNS.record_type=TXT by DNS.src DNS.dest DNS.answer DNS.record_type | `drop_dm_object_name("DNS")` | eval anslen=len(answer) | search anslen>100 | `ctime(firstTime)` | `ctime(lastTime)` | rename src as "Source IP", dest as "Destination IP", answer as "DNS Answer" anslen as "Answer Length" record_type as "DNS Record Type" firstTime as "First Time" lastTime as "Last Time" count as Count | table "Source IP" "Destination IP" "DNS Answer" "DNS Record Type" "Answer Length" Count "First Time" "Last Time" Seems like all the Network_Resolution datamodel message_type and answers are unknown: answer record_type message_type count unknown TXT unknown 44058 unknown TXT unknown 25818 unknown TXT unknown 22868 unknown TXT unknown 17916 unknown TXT unknown 16092 unknown TXT unknown 16087 unknown TXT unknown 8159 I cut out the src and dest, but as you can see I would get nothing since all the message_type's are unknown and the search is looking for responses. I think every bro DNS log is both a query and a response if the DNS server responds to the query. Do I need to do something special to get the message type of response and the data in the answers? I know that there is data in the answers field for the index=bro sourcetype=bro_dns: _time query qtype_name answers rcode_name tag vendor 28:53.2 10.231.36.73.imwyyj2pluwatbkhz2yqgkzte3fhckp.r.mail-abuse.com TXT TXT 143 Mail from 73.36.231.10 blocked using Trend Micro Email Reputation database. Please see <http://www.mail-abuse.com/cgi-bin/lookup?\\73.36.231.10> NOERROR dns,network,resolution Bro Anyone else using Bro to get DNS into Splunk? Thank you, Brian ... View more

BASE_SEARCH | rex field=dest_host "^(?<hostname>([a-z0-9\.\-]*\.)?(?<Domain>[a-z0-9\-]{2,}(?=\.[a-z\.]{3,})\.(?<tld>[a-z\.]{3,})))" | stats count as Visited by hostname Domain tld | eventstats sum(Visited) as Visited dc(hostname) as Subdomains by Domain tld | dedup Visited Subdomains Domain tld | table Subdomains Visited Domain | append [search BASE_SEARCH | rex field=dest_host "^(?<hostname>([a-z0-9\.\-]*\.)?(?<Domain>[a-z0-9\-]{2,}(?=\.[a-z\.]{3,})\.(?<tld>[a-z\.]{3,})))" | stats count as Visited by hostname Domain tld | eventstats sum(Visited) as Visited dc(hostname) as Subdomains by Domain tld | dedup Visited Subdomains Domain tld | stats sum(Visited) as Visited sum(Subdomains) as Subdomains by tld | rename tld as Domain] | sort 0 - Subdomains You can see that I have basically the same search twice once on the getting me the totals for the domain and then again to append the totals for the TLD: Here is my results that I am trying to get: Subdomains Visited Domain 13 18 com 3 3 googleapis.com 2 4 google.com 2 2 doubleverify.com 2 2 net 1 4 microsoft.com 1 1 evidon.com 1 1 gstatic.com 1 1 ivaws.com 1 1 krxd.net 1 1 live.net 1 1 outlook.com 1 1 yahoo.com Here is another way to do it but I repeat all the TLD data for each domain so I don't like the output as much: BASE_SEARCH | rex field=dest_host "^(?<hostname>([a-z0-9\.\-]*\.)?(?<Domain>[a-z0-9\-]{2,}(?=\.[a-z\.]{3,})\.(?<tld>[a-z\.]{3,})))" | stats sum(count) as Visited by hostname domain tld | eventstats sum(Visited) as Vis1 dc(hostname) as Subdomains by domain | eventstats sum(Visited) as Vis2 dc(hostname) as Sub2 by tld | dedup Vis1 Subdomains domain tld | rename Vis1 as Visited | rename domain as Domain | table Subdomains Visited Domain Sub2 Vis2 tld Subdomains Visited Domain Sub2 Vis2 tld 3 3 googleapis.com 13 18 com 2 4 google.com 13 18 com 2 2 doubleverify.com 13 18 com 1 4 microsoft.com 13 18 com 1 1 evidon.com 13 18 com 1 1 gstatic.com 13 18 com 1 1 ivaws.com 13 18 com 1 1 krxd.net 2 2 net 1 1 live.net 2 2 net 1 1 outlook.com 13 18 com 1 1 yahoo.com 13 18 com So basically I would like to have the results of the appended searches using only the single search like did with the second search if possible. Thank you, Brian ... View more