I would like to forward DNS events from my DNS server with a UF that is monitoring the dns.log debug output.
i am already forwarding WIndows Events under sourcetype=wineventlog
based on https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/SourcetypesandCIMdatamodelinfo
DNS Logs would also need to be under the same sourcetype name in order for the add on https://splunkbase.splunk.com/app/742/
to normalize the events
i do not wish to use the same sourcetype name for the win events and for the DNS
what am i missing?
If you want to use different sourcetype for DNS logs and want to utilize 'Splunk Add-on for Windows' for data normalization as per CIM, you can clone the configurations of 'wineventlog' sourcetype in 'props.conf' and rename the sourcetype to 'dns'.
Reference:
https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration
@omri_p
Can you upvote and accept the answer if it's helped you? Thanks.