https://community.splunk.com/t5/Splunk-Search/How-to-translate-SID-to-Username-via-the-Lookup-Table/m-p/415959#M119742 <P>I have a lookup file which contains various fields, including the username and corresponding SID (pulled from AD).</P> <P>I have a Windows event with data showing as User=NOT_TRANSLATED and Sid=(a value)</P> <P>The CSV file contains a field named User and a field named Sid that matches.</P> <P>I'm wanting to reference the lookup table to identify the username of the sid that is in the event data. </P> <P>There is is where I am, and obviously it isn't working: </P> <PRE><CODE>index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 [| inputlookup ldap_identities.csv | fields Sid,identity] | eval User=identity | stats count by Sid,User </CODE></PRE> <P>Any ideas?</P> Wed, 23 May 2018 15:19:53 GMT Kendo213 2018-05-23T15:19:53Z https://community.splunk.com/t5/Splunk-Search/How-to-translate-SID-to-Username-via-the-Lookup-Table/m-p/415959#M119742 <P>I have a lookup file which contains various fields, including the username and corresponding SID (pulled from AD).</P> <P>I have a Windows event with data showing as User=NOT_TRANSLATED and Sid=(a value)</P> <P>The CSV file contains a field named User and a field named Sid that matches.</P> <P>I'm wanting to reference the lookup table to identify the username of the sid that is in the event data. </P> <P>There is is where I am, and obviously it isn't working: </P> <PRE><CODE>index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 [| inputlookup ldap_identities.csv | fields Sid,identity] | eval User=identity | stats count by Sid,User </CODE></PRE> <P>Any ideas?</P> Wed, 23 May 2018 15:19:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-translate-SID-to-Username-via-the-Lookup-Table/m-p/415959#M119742 Kendo213 2018-05-23T15:19:53Z https://community.splunk.com/t5/Splunk-Search/How-to-translate-SID-to-Username-via-the-Lookup-Table/m-p/415960#M119743 <P>I figured this out:</P> <P>index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 | lookup ldap_identities.csv Sid OUTPUT identity | rename identity as User | stats count by User,Sid,host</P> Wed, 23 May 2018 18:09:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-translate-SID-to-Username-via-the-Lookup-Table/m-p/415960#M119743 Kendo213 2018-05-23T18:09:31Z https://community.splunk.com/t5/Splunk-Search/How-to-translate-SID-to-Username-via-the-Lookup-Table/m-p/415961#M119744 <P>How did you get the Sid/Username lookup?</P> Thu, 23 Jan 2020 22:59:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-translate-SID-to-Username-via-the-Lookup-Table/m-p/415961#M119744 bgriffis 2020-01-23T22:59:51Z