topic Re: Translate GUID in Windows Event Log? in Getting Data In

Translate GUID in Windows Event Log?

muebel — Tue, 14 Dec 2010 02:38:52 GMT

How would I configure Splunk to index WindowsEventLog events with the GUID's translated to their corresponding objects?

Re: Translate GUID in Windows Event Log?

muebel — Tue, 14 Dec 2010 03:03:41 GMT

Doc searching turned up the answer (I think):

http://www.splunk.com/base/Documentation/4.1.5/Admin/Inputsconf

evt_resolve_ad_obj = 1|0 Enables/disables resolving active directory objects like GUID/SID objects for a specific windows event log channel. By default this option it turned on for Security event logs. Optionally you can specify the Domain Controller name and/or DNS name of the domain to bind to which then splunk will use to resolve the AD objects.

Re: Translate GUID in Windows Event Log?

ftk — Tue, 08 Feb 2011 05:27:02 GMT

Hey muebel, did that solve your problem? If so please accept the answer as correct to close this question out. Thanks dude!

Re: Translate GUID in Windows Event Log?

hughkelley — Fri, 08 Apr 2011 21:04:43 GMT

Does this work for "remote pulled" event logs as well? I've put the following in inputs.conf but it does not seem to be doing lookups.

[default] evt_dc_name = evt_dns_name =

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0 index = eventlog_filtering_test evt_resolve_ad_obj = 1 # resolved GUIDs and SIDs in the event data