Getting Data In

Where can I find Splunk field names for AD event ID fields ?

fzuazo
Path Finder

Greetings all,

As the title states where can I find the Splunk equivalent of AD event ID fields ?

For example in the Splunk for AD app; AccountName is mapped to src_user. I would like some master list with the mappings and the equivalents between AD and Splunk, if such a thing exists.

I have searched everywhere and can't find it.

Thanks.

0 Karma
1 Solution

adonio
Ultra Champion

hello there,

i dont think a list exists however splunk doing a pretty good job with the Common Information Model
read all the way here:
http://docs.splunk.com/Documentation/CIM/4.11.0/User/Overview
download the app here:
https://splunkbase.splunk.com/app/1621/
verify that the app ou download or build with the add-on builder are CIM complient

hope it helps

View solution in original post

adonio
Ultra Champion

hello there,

i dont think a list exists however splunk doing a pretty good job with the Common Information Model
read all the way here:
http://docs.splunk.com/Documentation/CIM/4.11.0/User/Overview
download the app here:
https://splunkbase.splunk.com/app/1621/
verify that the app ou download or build with the add-on builder are CIM complient

hope it helps

fzuazo
Path Finder

This works, thank you !

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...