topic Re: SID not resolve on client server in Getting Data In

SID not resolve on client server

servcisco — Thu, 05 Nov 2020 15:00:44 GMT

Good afternoon! Installed the Splunk_TA_windows application on the server, edited the inputs1. On the SPLUNK server, the logs contain SID instead of name.

[WinEventLog: // Security]
disabled = 0
index = wineventlog
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
renderXml = false

Re: SID not resolve on client server

richgalloway — Thu, 05 Nov 2020 16:09:35 GMT

The event contains what Windows sent. There may be a setting on the Windows side to control this (but I doubt it) or setting renderXml = true may help.

Re: SID not resolve on client server

servcisco — Fri, 06 Nov 2020 07:25:06 GMT

Putting the setting "renderXml = true" did not help ( where can i see the reason?

Re: SID not resolve on client server

servcisco — Fri, 06 Nov 2020 08:26:32 GMT

Putting the setting "renderXml = true" did not help ( where can i see the reason?