Getting Data In
Highlighted

After updating our universal forwarders from Splunk 6.1.2 to 6.2.8, why is the Account_Name field not populated for Windows Security logs?

Path Finder

After updating our universal forwarders from 6.1.2 to 6.2.8 Windows Security logs are coming in without the Account_Name field populated. The SID is populated but that isn't nearly as useful as the username.

0 Karma
Highlighted

Re: After updating our universal forwarders from Splunk 6.1.2 to 6.2.8, why is the Account_Name field not populated for Windows Security logs?

SplunkTrust
SplunkTrust

Have you tried forcing your inputs.conf stanza to resolve the ad names?
Maybe another app is now disabling that.
Try adding the following:

evt_resolve_ad_obj = 1
0 Karma
Highlighted

Re: After updating our universal forwarders from Splunk 6.1.2 to 6.2.8, why is the Account_Name field not populated for Windows Security logs?

Path Finder

We are currently evaluating the impact of adding that stanza to the inputs.conf. I'll update when we have it implemented.

0 Karma