Splunk Search

How to reduce the DNS logs using regex?

kiran331
Builder

Hi

I have the DNS debug logs enabled, is there a way to index only failures ignoring the successful one's?

I have many events with NOERROR in msg, I hae to ignore the events with NOERROR in msg and index rest of events. how to edits props.conf and transforms.conf to make it work?

6/15/2017 9:54:10 AM 0CFC PACKET 000000F39767C180 UDP Snd 1.2.3.3 1603 R Q [8081 DR NOERROR] A (5)ctldl(13)windowsupdate(3)com(0)

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi
try with this configurations:

Props.conf

[your_sourcetype]
TRANSFORMS-set-DNS=set_DNS,set_nullqueue

Transforms.conf

########## discard ##########

[set_nullqueue]
REGEX=NOERROR 
DEST_KEY=queue
FORMAT=nullQueue

########## filter ##########

[set_DNS]
REGEX=.
DEST_KEY = queue
FORMAT = indexQueue

verify (using Splunk) if regex is correct!

For more information see http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
try with this configurations:

Props.conf

[your_sourcetype]
TRANSFORMS-set-DNS=set_DNS,set_nullqueue

Transforms.conf

########## discard ##########

[set_nullqueue]
REGEX=NOERROR 
DEST_KEY=queue
FORMAT=nullQueue

########## filter ##########

[set_DNS]
REGEX=.
DEST_KEY = queue
FORMAT = indexQueue

verify (using Splunk) if regex is correct!

For more information see http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

0 Karma

kiran331
Builder

Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...