Getting Data In

Splunk 7.2.3 Windows event 11707 user "NOT_TRANSLATED"

lball
Explorer

I'm trying to alert on software install events, but the events are showing the user as "NOT_TRANSLATED". I get a SID, but that isn't helpful for alerting. I have a distributed SPLUNK install (not sure if that matters). How do I get the user name info translated for the events?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.