In Windows Security logs Splunk is no longer resolving account names and instead showing SIDs

[JWBailey]

Good morning,

I noticed recently that some of my events in splunk are no longer displaying account names and group names from active directory correctly. Instead it is showing the SID of the object. We are running Splunk 6.3.3.

When I look at the source log in the event viewer on the host, it is properly displaying the account information. I have verified that evt_resolve_ad_obj = 1 for the Windows Security input and is not being overwritten with a different value.

I am not sure what else would be causing this.

Thanks,

[JWBailey · Accepted solution]

Apparently this was changed in the 6.2 product release. I found this in the notes when researching the upgrade to 6.5.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Installation/Aboutupgradingto6.5READTHISFIRST (second to last note)

According to splunk docs:

The default behavior for translating security identifiers (SID) and globally unique identifiers (GUIDs) when monitoring Windows Event Log data has changed
The etc_resolve_ad_obj attribute, which controls whether or not Splunk Enterprise attempts to resolve SIDs and GUIDs when it monitors event log channels, is now disabled by default for all channels. When you upgrade, any inputs.conf monitor stanzas that do not explicitly define this attribute will no longer perform this translation.

I followed the instructions and added the setting directly to inputs.conf. This fixed the problem.

[rashid47010]

can you please share the input.conf parameter along with their values