That worked a treat. Thank you so much for your help. ... View more

Doh! Before I read your reply, I just got this search working. I will read those links you posted tomorrow and try the search you suggested. Thank you for your response, I appreciate the help. sourcetype=logs target_page_hash=* earliest=@d latest=now | eval new_hash=target_page_hash | join target_page [| search sourcetype=logs earliest=-2d@d latest=@d target_page_hash=* | eval old_hash=target_page_hash] | where new_hash != old_hash | table target_page, old_hash, new_hash ... View more

Thanks for your response but that didn't work for me. I see no results. I'm having trouble understanding your code line-by-line also. I'm basically trying to compare the hash of the web page (url) from the previous day to the current day. There are numerous urls. ... View more

Thanks. I spoke to the developer of the "Windows DNS Analytical and Diagnostic Logs" app and they abandoned this project "due to constantly running into issues with trying to capture DNS logs via the recommended Microsoft methods." He suggested that I try Splunk Stream to capture DNS traffic and ingest it into Splunk. I only have Splunk Light in my lab so I guess I will try and figure out another way of ingesting logs into a SIEM for analysis. ... View more

I tried doing what you suggested and the events are arriving in Splunk. The logs aren't being parsed though. Are you seeing the same issue? Link to screen shot: https://www.dropbox.com/sh/4bzr3povr1vvdup/AADJ5reVFj-n1vQFQoXJWfOta?dl=0 Here is the contents of the file, C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-windnsanalytical\bin\get_dns_analytics.path C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-windnsanalytical\bin\get_dns_analytics.ps1'" No errors seen in splunkd.log on the Windows Server. I copied the app to the /opt/splunk/etc/apps/ folder on the Ubuntu server and restarted both the server and the client. Any ideas? ... View more

Thanks for your reply. I appreciate it. I did tinker with the "Windows DNS Analytical and Diagnostic Logs" app earlier but couldn't get it working. I will try the edits you mentioned and let you know how it goes. May I ask if you currently have a Windows Server sending logs to Splunk after testing it in the lab and, if so, which version of Windows and which app are you using? I'm exploring options to send Win Server DNS logs to Splunk for analysis by a security team. Thanks again ... View more

Did you figure out the answer to your question? I am experiencing the same issue. I can see event logs from the Windows Server 2012 R2 host in Splunk. I cannot see any DNS logs in Splunk after installing the app on both the Splunk server and the Win server. I enabled the DNS logging on the Win server using the steps here: https://technet.microsoft.com/en-us/library/dn800669.aspx#dbug I can see the DNS events being logged in "C:\Windows\System32\winevt\Logs\Microsoft-Windows-DNSServer%4Analytical.etl" and I can see this log file growing in size (over 512 KB right now). Here is the output of the inputs.conf file, on the Win server (C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_microsoft_dns\default\inputs.conf). # DNS Debug Logging # # Originally configured line: [MonitorNoHandle://C:\Windows\System32\Dns\dns.log] # Changing to the following to test if logs are forwarded to Splunk: [MonitorNoHandle://c:\Windows\System32\Winevt\Logs\Microsoft-Windows-DNSServer%4Analytical.etl] sourcetype=MSAD:NT6:DNS disabled=false index=msad Thanks in advance for any help. ... View more