Getting Data In

Where can I find Splunk field names for AD event ID fields ?

fzuazo
Path Finder

Greetings all,

As the title states where can I find the Splunk equivalent of AD event ID fields ?

For example in the Splunk for AD app; AccountName is mapped to src_user. I would like some master list with the mappings and the equivalents between AD and Splunk, if such a thing exists.

I have searched everywhere and can't find it.

Thanks.

0 Karma
1 Solution

adonio
Ultra Champion

hello there,

i dont think a list exists however splunk doing a pretty good job with the Common Information Model
read all the way here:
http://docs.splunk.com/Documentation/CIM/4.11.0/User/Overview
download the app here:
https://splunkbase.splunk.com/app/1621/
verify that the app ou download or build with the add-on builder are CIM complient

hope it helps

View solution in original post

adonio
Ultra Champion

hello there,

i dont think a list exists however splunk doing a pretty good job with the Common Information Model
read all the way here:
http://docs.splunk.com/Documentation/CIM/4.11.0/User/Overview
download the app here:
https://splunkbase.splunk.com/app/1621/
verify that the app ou download or build with the add-on builder are CIM complient

hope it helps

View solution in original post

fzuazo
Path Finder

This works, thank you !

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!