I am collecting syslogs from the network (UDP 514) and they are all coming in as sourcetype=syslog. I did not see a choice for auto. Because of this, I can't search for sourcetype=named. I tried to manually extract the fields but I keep getting the error "can't extract named fields". I need to be able to monitor the queries. Is there a way to make these events show as DNS queries?
You need to make splunk recognize that it's logs from named and then rewrite the sourcetype. The way you do this is with a combination of props.conf and transforms.conf
transforms.conf
[force_named_sourcetype]
SOURCE_KEY = MetaData::Source
DEST_KEY = MetaData::Sourcetype
REGEX = (named:)
FORMAT = sourcetype::named
props.conf
[source::udp:514]
TRANFORMS-force-named = force_named_sourcetype
Voilá!