All Apps and Add-ons

Example of Active Directory lookup

krugger
Communicator

Can anyone provide me an exemple of what the DomainList.csv and DomainSelector.csv lookups look like in the Splunk for Active Directory app?

I am only collecting the event log, so these lookups are not being generated, so I will have to create them manually to make the app work as expected.

0 Karma
1 Solution

treinke
Builder

cat /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/lookups/DomainList.csv

host,"src_nt_domain"
PDC01,PROD
PDC02,PROD
SDC02,STAGE
sdc01,STAGE
pdc3,PROD

cat /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/lookups/DomainSelector.csv

host,DomainNetBIOSName,DomainDNSName,ForestName,Site
sdc1,STAGE,"Stage.local","Stage.local","Default-First-Site-Name"
sdc2,STAGE,"Stage.local","Stage.local","Default-First-Site-Name"
PDC01,PROD,"Production.local","Production.local","Main-Office"
PDC02,PROD,"Production.local","Production.local","Main-Office"
pdc3,PROD,"Production.local","Production.local","DR-Site"
There are no answer without questions

View solution in original post

treinke
Builder

cat /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/lookups/DomainList.csv

host,"src_nt_domain"
PDC01,PROD
PDC02,PROD
SDC02,STAGE
sdc01,STAGE
pdc3,PROD

cat /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/lookups/DomainSelector.csv

host,DomainNetBIOSName,DomainDNSName,ForestName,Site
sdc1,STAGE,"Stage.local","Stage.local","Default-First-Site-Name"
sdc2,STAGE,"Stage.local","Stage.local","Default-First-Site-Name"
PDC01,PROD,"Production.local","Production.local","Main-Office"
PDC02,PROD,"Production.local","Production.local","Main-Office"
pdc3,PROD,"Production.local","Production.local","DR-Site"
There are no answer without questions
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...