Splunk® App for Windows Infrastructure

Deploy and Use the Splunk App for Windows Infrastructure

Download manual as PDF

This documentation does not apply to the most recent version of MSApp. Click here for the latest version.
Download topic as PDF

Sample DNS searches and dashboards

This topic lists searches that you can perform to confirm that Windows DNS data has arrived at the indexer.

Search Windows DNS data

To confirm that Windows DNS data is present on the indexer, use the Search app:

1. Log into Splunk Enterprise on the indexer, if you have not already.

2. Load the Search app. In the system bar, select Apps > Search & Reporting. Splunk loads the Search app.

3. Try the following searches to confirm that data is present:

This search confirms that the Splunk Add-on for Windows DNS are sending data to the indexer:

eventtype=perfmon-dns

Can't find the data?

Try the following:

  • Use Forwarder Management to confirm that the Splunk Add-on for Windows DNS have been deployed to your deployment clients.
  • Refer to the Troubleshooting manual for additional help.
PREVIOUS
Confirm and troubleshoot DNS data collection
  NEXT
Install the Splunk App for Windows Infrastructure on the search head

This documentation applies to the following versions of Splunk® App for Windows Infrastructure: 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.2.0, 1.2.1, 1.3.0, 1.4.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters