Along with the huge growth of Internet during the last decade, DNS has become a critical part of Internet itself that has equally grown and became more complex. Partly because of the attacks and failures that it has undergone, which have been studied and resolved. Due to its importance, it is vital to be prepared for those attacks that we already know as they are performed by more powerful sources as technology advances. That is why detecting these events properly on time would help combat them. However, the volume of today's DNS data puts another barrier to this goal, making more difficult to make detections. Moreover, new attacks and events are always possible, making the detection systems based on supervised training useless in these cases. This work takes in account all of these issues to propose a real-time attack and abnormal events detector and its components; made and evaluated from big volume real DNS data, from chilean .cl' top-level domain.