record DHCP:
nohup tcpdump -nns0 -C10 -W10 port 67 or port 68 -w /opt/tcpdump/dhcp.pcap -z /opt/tcpdump/pcap2txt.sh &>/dev/null &
where /opt/tcpdump/pcap2txt.sh is a script:
/usr/sbin/tcpdump -tttt -ev -nns0 port 67 or port 68 -r $1 > /opt/tcpdump/dhcp.txt
configure splunk to monitor /opt/tcpdump/dhcp.txt file and assign "dhcp" sourcetype manually.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.