Hello, I have these weird search results in the Splunk App for Windows Infrastructure and Splunk App for Microsoft Exchange where the src_nt_domain results in double my domain name. For example, my domain is 'abc' the results for the src_nt_domain field are ABC ABC. So I don't know if the inputlookup is causing this or if some ldap.conf file is messed up. specifically, the search is in the Active Directory tab of the Exchange app, then Users, then Anonymous and the search is from the Logons from Multiple Workstations widget/inline search.
Here's the search ...
eventtype=msad-successful-user-logons NOT (user="SYSTEM" OR user="LOCAL SERVICE" OR user="NETWORK SERVICE" OR src_nt_domain="-") (host="*") | lookup SiteInfo host | fields * | search (Logon_Type=2 OR Logon_Type=3 OR Logon_Type=10) src_ip!="-" | join src_ip [|inputlookup tHostInfo | table src_ip,src_host,src_nt_domain] | eval src_host=if(src_ip=="127.0.0.1" OR src_ip=="-",upper(host),src_host) | eval src_host=src_nt_domain."\\".src_host | stats dc(src_host) as hostcount,values(src_host) as Workstations by user,src_nt_domain | where hostcount>1 | search user="Wiley_Coyote" | sort user,src_nt_domain
which results in
User = Wiley_Coyote / src_nt_domain = ABC ABC / Hostcount = 2 / Workstations = ABC ABC\Road_Runner and ABC ABC\Bugs_Bunny
The ldap.conf file in the ldapsearch app seems to be configured properly to my domain and alias and baseDN...
Any suggestions?
Thanks!
