Metric events less than 150 bytes are recorded as event size in bytes plus 18 bytes, up to a maximum of 150 bytes. Metric events that exceed 150 bytes are recorded as only 150 bytes. However, the per-event size measurement is capped at 150 bytes. When ingesting metrics data, each metric event is measured by volume like event data.

Because the data is measured at the indexing pipeline, data that is filtered and dropped prior to indexing does not count against the license volume quota. It is not based on the amount of compressed data that is written to disk. When ingesting event data, the measured data volume is based on the raw data that is placed into the indexing pipeline. Part of the indexing process is to measure the volume of data being ingested, and report that volume to the license manager for license volume tracking. The captured event ID is 3008, which contains the information about every DNS query handled by the DNS Client service of Windows.When data is sent to the Splunk platform, that data is indexed and stored on disk. For every DNS query processed, the following information will be displayed: Host Name, Query Type (A, AAAA, and so on), Query Status (Error or succeeded), Query Result, Query Timestamp, ID, and name of the process that requested the DNS lookup.ĭNSLookupView works by utilizing the Windows event tracing with the 'Microsoft-Windows-DNS-Client' provider ( 1C95126E-7EEA-49A9-A3FE-A378B03DDB4D ). The UI will be familiar if you have used this author's other products.

This utility will be helpful for those that need to track down a potential attack or see if there is an issue with the DNS configuration causing connectivity issues on sites you are attempting to visit.

DNSLookupView permits you to monitor the details of all DNS queries sent via the Windows DNS Client service.

For ios instal DNSLookupView 1.12