After updating our universal forwarders from Splunk 6.1.2 to 6.2.8, why is the Account_Name field not populated for Windows Security logs?

[saulverde]

After updating our universal forwarders from 6.1.2 to 6.2.8 Windows Security logs are coming in without the Account_Name field populated. The SID is populated but that isn't nearly as useful as the username.

[javiergn]

Have you tried forcing your inputs.conf stanza to resolve the ad names?
Maybe another app is now disabling that.
Try adding the following:

evt_resolve_ad_obj = 1

[saulverde]

We are currently evaluating the impact of adding that stanza to the inputs.conf. I'll update when we have it implemented.