# Output Formats > The columns of the CSV data file, the two optional statistics files, and real sample outputs you can open before you run anything. --- LLMS index: [llms.txt](/llms.txt) --- `Convert-DNSDebugLogFile` produces up to three files per input log: | File | Contains | Created when | |---|---|---| | `.csv` | One row per parsed log entry | `-OutputType CSV` or `Both` | | `_Statistic.csv` | Daily record count per context | `-OutputType Statistic` or `Both` | | `_PacketStatistic.csv` | Daily query count per client, protocol, direction and record type | `-OutputType Statistic` or `Both` | `Both` is the default. Output lands next to the input file unless you set `-OutputFile`. The sample files linked on this page are real conversion results, not mock-ups. Download one and open it in Excel before you commit to a pipeline design. ## The CSV data file Sample output: | Locale | Details column | Files | |---|---|---| | en-US | not populated | [WithComputerName](../outputformat/en-us.-.dnsdebug-dc01.-.WithComputerName.csv), [NoComputerName](../outputformat/en-us.-.dnsdebug-dc01.-.NoComputerName.csv) | | de-DE | not populated | [WithComputerName](../outputformat/de-de.-.dnsdebug-dc01.-.WithComputerName.-.NoDetails.csv), [NoComputerName](../outputformat/de-de.-.dnsdebug-dc01.-.NoComputerName.-.NoDetails.csv) | | de-DE | populated | [WithComputerName](../outputformat/de-de.-.dnsdebug-dc01.-.WithComputerName.-.WithDetails.csv), [NoComputerName](../outputformat/de-de.-.dnsdebug-dc01.-.NoComputerName.-.WithDetails.csv) | Two rows from a real conversion — a DNS query and a server-internal note: ```text DateTime;ThreadId;Context;PacketId;Protocol;Direction;ClientIP;Xid;Type;Opcode;FlagsHex;FlagsChar;ResponseCode;QuestionType;QuestionName;Information;Details;ComputerName 2026-01-20 23:00:16;0FE0;Packet;000002C53117D990;UDP;Rcv;10.0.0.2;c049;Query;Standard;0001;RecursionDesired;NOERROR;A;"odc.officeapps.live.com";"";"";dc01 2026-01-20 23:00:16;DF0;Note;;;;;;;;;;;;"";"got GQCS failure on a dead socket context status=995, socket=904";"";dc01 ``` ### Columns Always 18 columns, always in this order: | # | Column | Meaning | Typical use | |---|---|---|---| | 1 | `DateTime` | Timestamp of the entry | Time filtering, joining with other logs | | 2 | `ThreadId` | DNS server worker thread | Rarely needed; useful when correlating server-internal issues | | 3 | `Context` | Kind of entry: `Packet`, `Event`, `Note`, `DSPoll`, `Init`, `Lookup`, `Recurse`, `Remote`, `Tombstone` | First filter you will apply — `Packet` is the actual DNS traffic | | 4 | `PacketId` | Internal packet identifier | Pairing a query with its response | | 5 | `Protocol` | `UDP` or `TCP` | TCP spikes can indicate large responses or zone transfers | | 6 | `Direction` | `Rcv` (query came in) or `Snd` (server answered) | Split request volume from response volume | | 7 | `ClientIP` | Address of the querying host | Top-talker analysis, incident scoping | | 8 | `Xid` | DNS transaction ID (hex) | Matching request and response | | 9 | `Type` | `Query` or `Response` | | | 10 | `Opcode` | `Standard`, `Notify`, `Update`, `Unknown` | Separates dynamic updates and zone notifications from normal lookups | | 11 | `FlagsHex` | Raw header flags (hex) | For deep protocol analysis | | 12 | `FlagsChar` | Decoded flags: `Authoritative`, `Truncated`, `RecursionDesired`, `RecursionAvailable` | Readable version of the above | | 13 | `ResponseCode` | `NOERROR`, `NXDOMAIN`, `SERVFAIL`, … | Error-rate reporting, resolution failure hunting | | 14 | `QuestionType` | Record type: `A`, `AAAA`, `MX`, `PTR`, `TXT`, … | `TXT` volume is a classic tunneling indicator | | 15 | `QuestionName` | Queried name as a normal FQDN | Threat-intel matching, top-domain reports | | 16 | `Information` | Free text for `Event` / `Note` entries; for `Packet` detail blocks the TCP/UDP detail header line | Reading server messages | | 17 | `Details` | JSON representation of a `Packet` detail block; empty otherwise | Full packet inspection without going back to the raw log | | 18 | `ComputerName` | Source server, from `-ComputerName` | Keeping multi-server datasets attributable | Two things to plan around: - **Not every column is filled for every row.** Only `Packet` entries have a client IP, a question name and a response code. `Note` and `Event` rows carry their text in `Information` and leave the protocol columns empty. Design your database schema and dashboard filters accordingly. - **`ComputerName` is always the last column, even when you do not use `-ComputerName`.** It is then simply empty. This keeps the layout identical across all servers so you can concatenate files from many DNS servers without a column-mapping step. ### The Details column Detail blocks only appear if the DNS server is configured to log full packet details. When they exist, the parser converts them into a single JSON value so the row stays one row: ```json { "Socket": "848", "Remote": "addr 10.10.0.11, port 60580", "Buflength": "0x10000 (65536)", "Message": { "XID": "0x0001", "OPCODE": "0 (QUERY)", "RCODE": "0 (NOERROR)", "QUESTION": [ { "Name": "berlin.de", "QTYPE": "A (1)", "QCLASS": "1" } ], "ANSWER": [] } } ``` Parsing these blocks costs time and makes the CSV considerably larger. If you do not need them, use `-NoDetailsParsing` — the column stays present but empty, and conversion gets faster. See [Performance](../04-performance/). ## The statistics files Statistics are daily aggregates. Use them when you want a trend or a rollup and do not want to move the full record set around — they are orders of magnitude smaller than the data file. ### Context statistics (`*_Statistic.csv`) Answers: *how much of what kind of activity happened per day?* ```text Date;Context;Count;ComputerName 2026-01-20;Event;2;dc01 2026-01-20;Note;2;dc01 2026-01-20;Packet;12;dc01 ``` | Column | Meaning | |---|---| | `Date` | Day, always `yyyy-MM-dd` | | `Context` | Context name (`Packet`, `Event`, `Note`, …) | | `Count` | Number of records of that context on that day | | `ComputerName` | Source server | Sample files: [en-US WithComputerName](../outputformat/en-us.-.dnsdebug-dc01_Statistic.-.WithComputerName.csv), [en-US NoComputerName](../outputformat/en-us.-.dnsdebug-dc01_Statistic.-.NoComputerName.csv), [de-DE WithComputerName](../outputformat/de-de.-.dnsdebug-dc01_Statistic.-.WithComputerName.csv), [de-DE NoComputerName](../outputformat/de-de.-.dnsdebug-dc01_Statistic.-.NoComputerName.csv) ### Packet statistics (`*_PacketStatistic.csv`) Answers: *who queried what, how often, per day?* ```text Date;ClientIP;Protocol;Direction;QuestionType;Count;ComputerName 2026-01-20;10.0.0.1;UDP;Rcv;A;3;dc01 2026-01-20;10.0.0.1;UDP;Snd;A;3;dc01 2026-01-20;10.0.0.2;UDP;Rcv;A;3;dc01 ``` | Column | Meaning | |---|---| | `Date` | Day, always `yyyy-MM-dd` | | `ClientIP` | Querying host | | `Protocol` | `UDP` or `TCP` | | `Direction` | `Rcv` or `Snd` | | `QuestionType` | DNS record type | | `Count` | Number of matching packets that day | | `ComputerName` | Source server | Sample files: [en-US WithComputerName](../outputformat/en-us.-.dnsdebug-dc01_PacketStatistic.-.WithComputerName.csv), [en-US NoComputerName](../outputformat/en-us.-.dnsdebug-dc01_PacketStatistic.-.NoComputerName.csv), [de-DE WithComputerName](../outputformat/de-de.-.dnsdebug-dc01_PacketStatistic.-.WithComputerName.csv), [de-DE NoComputerName](../outputformat/de-de.-.dnsdebug-dc01_PacketStatistic.-.NoComputerName.csv) ## Delimiter and date format Both output types respect `-Delimiter` (default `;`) and `-OutputCulture`. For anything that will be imported by a machine, write ISO-like timestamps: ```powershell Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -OutputCulture 'sv-SE' ``` That yields `2026-01-20 23:00:16`, which SQL Server, Power BI and pandas all read without a format hint. Details in [Parameters and Options](../03-parameters-and-options/).