I'm trying to troubleshoot an repeated authentication failure by specific users(s). When I try to filter the search with (user account status=failure) I see all failure events with the details below.
host - domain controllers (AD servers) of that region where user is in
source - WinEventLog:Security
sourcetype - WinEventLog:Security
Only concern is, i don't see the src_ip field showing any IP address. It just has a dash (hyphen)
The other fields are fine as listed below.
src - domain controllers
src_ip - dash (hypen)
src_user - account name of the user in the AD
Can someone help why the src_ip isn't populating ? Is that because Splunk couldn't determine it ? or any config tweaks has to be done ?
Please help !
