Getting Data In
Highlighted

How to get the correct gid/uid on windows fschange events

Communicator

All of my events show up with gid=-1,uid=-1. Is this a bug or am I doing something wrong?

Tags (2)
Highlighted

Re: How to get the correct gid/uid on windows fschange events

Splunk Employee
Splunk Employee

Windows does not have a gid or uid, thus these fields come in as "unset". The equivalent concepts on Windows are owner and ACL list, which cannot be expressed as two numbers.

If we don't currently capture Owner, that's kind of a shame. It shouldn't be too difficult to put that in a field. ACL list is pretty tricksy as it can be arbitrarily complex. Should at least be an ER to capture that stuff.

View solution in original post

Highlighted

Re: How to get the correct gid/uid on windows fschange events

Communicator

I agree!!! Or at least put asterisks on your compliance advertisements!

0 Karma
Highlighted

Re: How to get the correct gid/uid on windows fschange events

Splunk Employee
Splunk Employee

If our marketing collateral is out of step with the hard requirements of compliance specifications, that definitely deserves to be addressed. Get the ball rolling with a support ticket. Eventually it becomes an internal discussion to get things sorted, I think, but you'd be doing us a favor to apply the lever.

0 Karma