- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
Generate a reports on DNS records changes
[ Edited ]- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-19-2019 08:01 PM - edited 08-19-2019 08:02 PM
Hi,
Is there any way I can produce a report which shows all the DNS record changes done within a time frame in a DNS view?
I would like to generate a report which shows all the new, edited and deleted records inside the Internal view.
Solved! Go to Solution.
Re: Generate a reports on DNS records changes
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-20-2019 10:00 AM
Hi,
This should do it. Pretty straight forward.
index=ib_audit sourcetype=ib:audit earliest=@d DnsView=NAME ACTION=Created OR Modified OR Deleted OBJECT_TYPE=*Record |table TIMESTAMP, ADMIN, ACTION, OBJECT_TYPE, OBJECT_NAME |rename ACTION as Action, TIMESTAMP as Time, ADMIN as User, OBJECT_TYPE as "Record Type", OBJECT_NAME as "Record Name/Data"
Note:
Replace DnsView=NAME with the name of your DNS View
earliest=@d --> Data for the day from 00:00hrs
earliest=-2d or -1w or -24h --> Data from days ago or 1 week ago or 24 hours ago, till now
earliest=-2d@d --> Data from 00:00 hrs day before yesterday
Best Regards,
Bibin Thomas
Re: Generate a reports on DNS records changes
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-22-2019 08:57 PM
Re: Generate a reports on DNS records changes
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-23-2019 07:58 AM
No field extraction needed since the field is already available. You just need to add it to your table.
index=ib_audit sourcetype=ib:audit earliest=-7d DnsView=Axe ACTION=Created OR Modified OR Deleted OBJECT_TYPE=*Record |table TIMESTAMP, ADMIN, ACTION, OBJECT_TYPE, OBJECT_NAME, comment |rename ACTION as Action, TIMESTAMP as Time, ADMIN as User, OBJECT_TYPE as "Record Type", OBJECT_NAME as "Record Name/Data". comment as Comment
Best Regards,
Bibin Thomas