# Flow stats in dns\_end event

**URL:** <https://community.zeek.org/t/flow-stats-in-dns-end-event/6099>\
**Category:** Zeek\
**Created:** [April 22, 2020, 7:13am UTC](https://community.zeek.org/t/flow-stats-in-dns-end-event/6099 "2020-04-22T07:13:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nabil\_Memon](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@Nabil\_Memon](https://community.zeek.org/u/Nabil_Memon)\
**Post date:** [April 22, 2020, 7:13am UTC](https://community.zeek.org/t/flow-stats-in-dns-end-event/6099/1 "2020-04-22T07:13:27Z")

</div>

Hi,

event dns\_end(c: connection, msg: dns\_msg)  
{  
print “dns\_end: -------------------------------”;  
print c$orig, c$resp, c$id, c$dns;  
print “dns\_end: -------------------------------”;  
}

Output:

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [April 22, 2020, 5:22pm UTC](https://community.zeek.org/t/flow-stats-in-dns-end-event/6099/2 "2020-04-22T17:22:28Z")

</div>

Yes, the "dns\_end" event and associated values can get  
created/enqueued before the states are updated. However, the updated  
stats \*are\* technically available by the time the event gets  
dispatched, so one trick to refresh the connection record value would  
be to use "lookup\_connection()". See if this helps:

event dns\_end(c: connection, msg: dns\_msg)  
{  
c = lookup\_connection(c$id);  
print "dns\_end: -------------------------------";  
print c$orig, c$resp, c$id, c$dns;  
print "dns\_end: -------------------------------";  
}

- Jon

---

<div class="post-metadata">

**Author:** ![Nabil\_Memon](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@Nabil\_Memon](https://community.zeek.org/u/Nabil_Memon)\
**Post date:** [April 22, 2020, 6:54pm UTC](https://community.zeek.org/t/flow-stats-in-dns-end-event/6099/3 "2020-04-22T18:54:42Z")

</div>

Awesome, thanks!

It worked.

Nabil

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/flow-stats-in-dns-end-event/6099/4 "2022-05-06T15:47:13Z")

</div>