Splunk add on for microsoft windows - Splunk Community

Splunk Enterprise Security

After installing microsoft windows add on I could not see applicable tags for network resolution data model with respect to DNS logs.

Why I could not see any tag? Any thoughts!

Where and how are you looking for tags? Do you have any DNS data indexed?

---
If this reply helps you, Karma would be appreciated.

Yes, dns data indexed.

For mapping with datamodel I am searching at settings > Tags.

Because I could see two tags in datamodel page which are required for network resolution datamodel.

1 Resolution and 2.dns

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...