Troubleshoot the Splunk Add-on for Windows DNS
For helpful troubleshooting tips that you can apply to all add-ons, see "Troubleshoot add-ons". You can also access these support and resource links.
Data appears in the wrong index
The Splunk Add-on for Windows DNS expects the following indexes to be present on your indexers:
windows(for backward compatibility)
wineventlog(for backward compatibility)
Ensure those indexes are present by installing the add-ons into all indexers in the deployment.
Sourcetype changes for WinEventLog data
The Splunk Add-on for Windows version 5.0.x introduces changes to WinEventLog data sourcetypes, and now assigns the WinEventLog sourcetype to the following WinEventLog input of the Splunk Add-on for Microsoft DNS:
|Windows AD input||Sourcetype|
WinEventLogs are distinguished by their source.
Configure the Splunk Add-on for Windows DNS
Lookups for the Splunk Add-on for Windows DNS
This documentation applies to the following versions of Splunk® Add-on for Microsoft Windows DNS (Legacy): 1.0.0, 1.0.1
Feedback submitted, thanks!