topic Static map of user ID with user name in Splunk Search

Static map of user ID with user name

nuwan — Thu, 12 Jul 2012 16:01:17 GMT

A finger print server log generates a user ID. Active directory log has user name. I have excel sheet for the user ID to user name mapping.
Could I use splunk to create a static table to map user ID with user name .basically my need is if the user is on leave ( no log on the finger print server) then if some one uses his password to acess active directory an incident should be created.

Could this be achieved in splunk.

Thank you in advance

Re: Static map of user ID with user name

lguinn2 — Thu, 12 Jul 2012 20:27:59 GMT

Yes. Save your spreadsheet as a comma-separated values file (CSV), then load it into Splunk as a lookup table. Here is the documentation: Create and Configure Field Lookups. Be sure to set the advanced options, so that you return a value (such as "Unknown") if there is no match in the lookup table.

Assuming the following names:

id_lookup - the name of the lookup you created
fingerprint.log
userId (for the field in the fingerprint.log and the id_lookup)
WinEvent:Security - the sourcetype of the active directory log
userName (for the field in the active directory log and the id_lookup)

The following search will return any events that have a userName that is not in the lookup table.

sourcetype=WinEvent::Security | lookup id_lookup userName OUTPUT userId | where userId="Unknown"

This search does not access the fingerprint.log; I don't think it needs to, but perhaps I do not understand the question fully.

Re: Static map of user ID with user name

nuwan — Fri, 13 Jul 2012 01:24:16 GMT

Thank you. I will try this and get back to you.