topic Where can I find Splunk field names for AD event ID fields ? in Getting Data In

Where can I find Splunk field names for AD event ID fields ?

fzuazo — Mon, 04 Jun 2018 21:07:47 GMT

Greetings all,

As the title states where can I find the Splunk equivalent of AD event ID fields ?

For example in the Splunk for AD app; AccountName is mapped to src_user. I would like some master list with the mappings and the equivalents between AD and Splunk, if such a thing exists.

I have searched everywhere and can't find it.

Thanks.

Re: Where can I find Splunk field names for AD event ID fields ?

adonio — Mon, 04 Jun 2018 22:53:16 GMT

hello there,

i dont think a list exists however splunk doing a pretty good job with the Common Information Model
read all the way here:
http://docs.splunk.com/Documentation/CIM/4.11.0/User/Overview
download the app here:
https://splunkbase.splunk.com/app/1621/
verify that the app ou download or build with the add-on builder are CIM complient

hope it helps

Re: Where can I find Splunk field names for AD event ID fields ?

fzuazo — Tue, 05 Jun 2018 15:09:25 GMT

This works, thank you !