Sample DNS searches and dashboards
This topic lists searches that you can perform to confirm that Windows DNS data has arrived at the indexer.
To users who are using TA-windows v6.0.0: TA-DNS merged with TA-windows. See Get data from TA-Windows v6.0.0 or later(Link).
Search Windows DNS data
To confirm that Windows DNS data is present on the indexer, use the Search app:
- Log into Splunk Enterprise on the indexer, if you have not already.
- Load the Search app. In the system bar, select Apps > Search & Reporting. Splunk loads the Search app.
- Try the following searches to confirm that data is present:
This search confirms that the Splunk Add-on for Windows DNS are sending data to the indexer:
Can't find the data?
Try the following:
- Use Forwarder Management to confirm that the Splunk Add-on for Windows DNS have been deployed to your deployment clients.
- Refer to the Troubleshooting manual for additional help.
Confirm and troubleshoot DNS data collection
Install the Splunk App for Windows Infrastructure on the Search Head
This documentation applies to the following versions of Splunk® App for Windows Infrastructure (Legacy): 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.1
Feedback submitted, thanks!