https://community.splunk.com/t5/Getting-Data-In/AccountName-disappears-when-I-forward-Windows-Security-Eventlogs/m-p/500039#M100205 <P>I have 5 computer who send security logs to a server. This server forward those logs to my splunk server so I can put them on a dashboard and I can send email alerts when the account "Administrator" is used.<BR /> My problem is that I can see the account name on my server but on Splunk web app those informations dissapear from the logs so I can't sepparate logs by the user.</P> <P>Does someone can help me with this please?</P> Tue, 03 Dec 2019 08:52:51 GMT rmarietan 2019-12-03T08:52:51Z https://community.splunk.com/t5/Getting-Data-In/AccountName-disappears-when-I-forward-Windows-Security-Eventlogs/m-p/500039#M100205 <P>I have 5 computer who send security logs to a server. This server forward those logs to my splunk server so I can put them on a dashboard and I can send email alerts when the account "Administrator" is used.<BR /> My problem is that I can see the account name on my server but on Splunk web app those informations dissapear from the logs so I can't sepparate logs by the user.</P> <P>Does someone can help me with this please?</P> Tue, 03 Dec 2019 08:52:51 GMT https://community.splunk.com/t5/Getting-Data-In/AccountName-disappears-when-I-forward-Windows-Security-Eventlogs/m-p/500039#M100205 rmarietan 2019-12-03T08:52:51Z