https://community.splunk.com/t5/Getting-Data-In/Where-does-the-mapping-of-Account-Name-to-src-happen-for-the/m-p/495665#M84525 <P>HI danielbb,<BR /> This question doesn't seem a Splunk question, could you give more details?</P> <P>Ciao.<BR /> Giuseppe</P> Sat, 12 Oct 2019 14:31:50 GMT gcusello 2019-10-12T14:31:50Z https://community.splunk.com/t5/Getting-Data-In/Where-does-the-mapping-of-Account-Name-to-src-happen-for-the/m-p/495664#M84524 <P>I'm not clear where and when the src field gets its value for the WinEventLog data.</P> Fri, 11 Oct 2019 17:02:20 GMT https://community.splunk.com/t5/Getting-Data-In/Where-does-the-mapping-of-Account-Name-to-src-happen-for-the/m-p/495664#M84524 danielbb 2019-10-11T17:02:20Z https://community.splunk.com/t5/Getting-Data-In/Where-does-the-mapping-of-Account-Name-to-src-happen-for-the/m-p/495665#M84525 <P>HI danielbb,<BR /> This question doesn't seem a Splunk question, could you give more details?</P> <P>Ciao.<BR /> Giuseppe</P> Sat, 12 Oct 2019 14:31:50 GMT https://community.splunk.com/t5/Getting-Data-In/Where-does-the-mapping-of-Account-Name-to-src-happen-for-the/m-p/495665#M84525 gcusello 2019-10-12T14:31:50Z https://community.splunk.com/t5/Getting-Data-In/Where-does-the-mapping-of-Account-Name-to-src-happen-for-the/m-p/495666#M84526 <P>This should be happening in the <CODE>Splunk_TA_windows</CODE> app. Check the <CODE>props.conf</CODE> and <CODE>transforms.conf</CODE> in the <CODE>default</CODE> directory.</P> Sun, 13 Oct 2019 05:49:20 GMT https://community.splunk.com/t5/Getting-Data-In/Where-does-the-mapping-of-Account-Name-to-src-happen-for-the/m-p/495666#M84526 woodcock 2019-10-13T05:49:20Z