You can create a logging endpoint that stores all DNS queries in your network.
- You can only assign one logging endpoint per site.
- You can assign a logging endpoint to multiple sites.
- You can create multiple logging endpoints but only one can be assigned per site. This means you can assign different logging endpoints to sites.
- Choose whether you are using HTTP or HTTPS.
- In the top navigation bar, click and select Logging Endpoints.
- Click .
Complete the following:
- Name: The unique name for the logging endpoint.
- Optional: Description: A description for the logging endpoint.
- Internal Network Address: The full URL of the local logging endpoint including the protocol and host. For example, https://http-inputs-<customer>.splunkcloud.com/services/collector/raw.
- Optional: Headers: The HTTP headers for authenticating the request. For example, -H "X-Splunk-Request-Channel: FE0ECFAD-13D5-401B-847D-77833BD77131"
- Optional: Client Certificate: The self-signed certificate for the host address. This could be generated using OpenSSL or your own internal tool. The self-signed certificate generates two parts: the client certificate and the server certificate. You must upload the client certificate to the logging endpoint and the server certificate to the server. If you have a load balancer, you must upload the server certificate to the load balancer.
- Click Save.