Sample DNS searches and dashboards

This topic lists searches that you can perform to confirm that Windows DNS data has arrived at the indexer.

To users who are using TA-windows v6.0.0: TA-DNS merged with TA-windows. See Get data from TA-Windows v6.0.0 or later(Link).

Search Windows DNS data

To confirm that Windows DNS data is present on the indexer, use the Search app:

1. Log into Splunk Enterprise on the indexer, if you have not already.
2. Load the Search app. In the system bar, select Apps > Search & Reporting. Splunk loads the Search app.
3. Try the following searches to confirm that data is present: This search confirms that the Splunk Add-on for Windows DNS are sending data to the indexer:

   eventtype=perfmon-dns

Can't find the data?

Try the following:

• Use Forwarder Management to confirm that the Splunk Add-on for Windows DNS have been deployed to your deployment clients.
• Refer to the Troubleshooting manual for additional help.