NextDNS App for Splunk
Hi NextDNS community,
I'm a huge fan of this tool and in my day job I'm a Splunk professional. I've written a series of dashboards for use with NextDNS logs, this is being published to Splunkbase or you can download it from my Git Repo:
https://github.com/jameswintermute/NextDNS_APP
It is unofficial and a community built app, any suggestions or feedback gratefully received. This is fully compatible with a free Splunk licence and no purchase of any kind necessary.
11 replies
-
The App has now been approved by Splunk and is publically listed on the Splunkbase website:
https://splunkbase.splunk.com/apps?keyword=NextDNS
If anybody at NextDNS would like to get in touch with me I'd be pleased to update and improve it and collaborate with you. NextDNS is great and I want more people to know about it and the logging output to improve!
-
Hi.
I really love these applications but I do have a big problem and I have been struggling with this.
Every time I do a curl command (the same you provided) I do get duplicates in my index. So lets say I have 1000 DNS queries and I run the curl command via crontab 10 times I suddenly have 10000 or so search results.I have been experimenting with crcSalt, initCrcLength and a lot of other things but still everything is duplicated. Think I have depleted internet of answers..
Also I am using the example input Stanza from the TA app.
Can you please advise?
Br Robert
-
I found a wa for this issue so everything works fine now but this was not fixed on Splunk side.
I have 3 cronjobs that are handling this instead.
55 0-23/1 * * * cat foo.log > bar.log
0 0-23/1 * * * curl -X GET -H "X-Api-Key: <value>" -s -L https://api.nextdns.io/profiles/xxxxxx/logs/download > /var/log/nextdns/foo.log
5 0-23/1 * * * grep -xvFf bar.log foo.log > nextdns.log
Basically what this does is creating a copy of the downloaded file "bar.log" then the Nextdns log is being curled (foo.log)
last step is a comparison between these 2 files and the new lines will be sent to nextdns.log that the TA should monitor. This way only new log entries will be sent to Splunk Index.
Now all duplicate issues are gone.
If someone else has a good fix for this please let me know. :)
Br Robert
Content aside
-
3
Likes
- 3 mths agoLast active
- 11Replies
- 261Views
-
3
Following