Index=infoblox sourcetype='infoblox:dns' $wild$ | table _time, host, message_type, record_type, query, dns_request_client_ip, dns_request_client_port, dns_request_name_serverIP, named_message | top limit=0 dns_request_client_ip | tstats count where index=infoblox, sourcetype='infoblox:dns' by host This is a high volume data feed - Be mindful of your time range Feel free to leave comments in the section below. We hope this article helps other save time. Index=infoblox sourcetype='infoblox:dns' | table _time, host, message_type, record_type, query, dns_request_client_ip, dns_request_client_port, dns_request_name_serverIP, named_message | top limit=0 dns_request_client_ipĬombine a few panels together and we will have a dashboard similar to the one in the dashboard code section at the bottom of the article.Įven though we only had a Splunk TA (and not an app to go with it), we used the flexibility provided within Splunk to gain insight into Infoblox DNS logs.

Now that the data is somewhat parsed, we can use the following to table the data: Unfortunately, the Infoblox TA ( ) does not seem to parse all the fields, but it might get you relatively close. L = response contains DTC synthetic record

V = responding server has validated DNSSEC records T = truncated response (from DNS message header)Į = EDNS OPT record present (from DNS message header) + = recursion available (from DNS message header)Ī = authoritative answer (from DNS message header) Set up a dictionary to hold your results results = )'.0 20:16:49.083 client 10.120.20.198#57398 UDP: query: a2.foo.com IN A response: NOERROR +AED a2.foo.com. # readlines() will return the data as a list of strings, one for each line I would really like some help on what path to take to tackle this problem should I use lists and loop through it or dictionaries/tuples?įirst you'll want to read in the text file # Open the file 'Īnd I wanted to parse the log file using Python to make it look like this as the result: I have a log file which looks like this: 'No.','Time','Source','Destination','Protocol','Info' I am new to program and python was the most recommended first program by many people.Īnyways. This is my first question asked here at stackoverflow and am really looking forward to being part of this community.

Parse dns log