Example of Active Directory lookup

[krugger]

Can anyone provide me an exemple of what the DomainList.csv and DomainSelector.csv lookups look like in the Splunk for Active Directory app?

I am only collecting the event log, so these lookups are not being generated, so I will have to create them manually to make the app work as expected.

[treinke · Accepted solution]

cat /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/lookups/DomainList.csv

host,"src_nt_domain"
PDC01,PROD
PDC02,PROD
SDC02,STAGE
sdc01,STAGE
pdc3,PROD

cat /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/lookups/DomainSelector.csv

host,DomainNetBIOSName,DomainDNSName,ForestName,Site
sdc1,STAGE,"Stage.local","Stage.local","Default-First-Site-Name"
sdc2,STAGE,"Stage.local","Stage.local","Default-First-Site-Name"
PDC01,PROD,"Production.local","Production.local","Main-Office"
PDC02,PROD,"Production.local","Production.local","Main-Office"
pdc3,PROD,"Production.local","Production.local","DR-Site"