Configure the Splunk Add-on for Windows DNS

The Splunk Add-on for Windows DNS does not require configuration as packaged by Splunk. To gain the knowledge that the add-on provides, install it into universal forwarders on your Windows DNS Server hosts. If a Windows host holds both Active Directory Domain Services and DNS Server roles, install this add-on and the Splunk Add-on for Microsoft Active Directory into the same universal forwarder.

Additionally, to get the search time extractions that the add-on provides, install both this add-on and the Splunk Add-on for Microsoft Active Directory into the indexers that receive Active Directory and DNS data, and any search heads that connect to and search those indexers.