Getting Data In

AccountName disappears when I forward Windows Security Eventlogs


I have 5 computer who send security logs to a server. This server forward those logs to my splunk server so I can put them on a dashboard and I can send email alerts when the account "Administrator" is used.
My problem is that I can see the account name on my server but on Splunk web app those informations dissapear from the logs so I can't sepparate logs by the user.

Does someone can help me with this please?

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...