I've been testing out the data input Active Directory Monitoring on my new Splunk 4.3 implementation. I've been able to get results in and have done some controlled tests to see what sort of data this will give, however, one thing that I've noticed with the results is that any events that show up, do not show the name, SID, or account of the administrator who has made the change.
Does anyone know if you can get this type of information from this data input? Or maybe associate it with an appropriate security event from the DC?
Given the problem, you want to use a Splunk Universal Forwarder to read the WinEventLog:Security. The Splunk App for Active Directory provides all the field extractions necessary to do what you need to do.