Retrieve the windows owner of a monitored file. (To create a field or rename the source)

[bvivi57]

Hello,

we monitor files generated by processes launched by several users on the same server. There is not in the name of the files the reference of the user. On the other hand, the user is informed as the owner in the NTFS rights of the file. Is there a solution to retrieve this information to use it as a field value or to rename the splunk source by adding this information. This would allow us to build dashboards by users.

Thanks for your help

[richgalloway]

Nothing like that is built into Splunk.  Consider writing a script that reads the files and adds the owner as a field.