Troubleshoot the Splunk Add-on for Windows DNS
Data appears in the wrong index
The Splunk Add-on for Windows DNS expects the following indexes to be present on your indexers:
windows(for backward compatibility)
wineventlog(for backward compatibility)
Ensure those indexes are present by installing the add-ons into all indexers in the deployment.
Sourcetype changes for WinEventLog data
The Splunk Add-on for Windows version 5.0.x introduces changes to WinEventLog data sourcetypes, and now assigns the WinEventLog sourcetype to the following WinEventLog input of the Splunk Add-on for Microsoft DNS:
|Windows AD input||Sourcetype|
WinEventLogs are distinguished by their source.
Configure the Splunk Add-on for Windows DNS
Lookups for the Splunk Add-on for Windows DNS
This documentation applies to the following versions of Splunk® Add-on for Microsoft Windows DNS (Legacy): 1.0.0, 1.0.1