All,
I'm stuck on a regex issue. Not sure how I can match A records vs AAAA records within windows dns logs. I came up with the following:
sourcetype=windns* | rex "NOERROR]\s(?
However, my AAAA records don't return, I'm thinking this is because the A is matched and the match stops there. How would one match A and AAAA records?
Here is a sample data set:
20131021 12:24:06 1190 PACKET 05D2B130 UDP Rcv 192.168.x.x e31f Q [0001 D NOERROR] A test.example.com
20131021 12:24:06 1190 PACKET 1D4EE140 UDP Rcv 192.168.x.x 3d6d Q [0001 D NOERROR] AAAA test.example.com
Any pointers or assistance would be helpful.
Thanks
Why be so specific? Just take everything between "NOERROR]" and the DNS name as the record type.
| rex "NOERROR]\s(?<record_type>.*?)\s" |
If you only want to see specific record types, use a where clause after the rex.
Might be answering my own question but I think I found a solution with the following:
sourcetype=windns* | rex "NOERROR]\s(?<record_type>(?:A|PTR|SRV|TXT|\bAAAA\b))\s" | table record_type
. Still open to how others would solve this though.
Why be so specific? Just take everything between "NOERROR]" and the DNS name as the record type.
| rex "NOERROR]\s(?<record_type>.*?)\s" |
If you only want to see specific record types, use a where clause after the rex.
Please accept this answer if it solves your problem.
Wow, this is much better I tried .* route but never added the ? hence I went the specific route. Thanks for pointing this out.