As the title states where can I find the Splunk equivalent of AD event ID fields ?
For example in the Splunk for AD app; AccountName is mapped to src_user. I would like some master list with the mappings and the equivalents between AD and Splunk, if such a thing exists.
I have searched everywhere and can't find it.
i dont think a list exists however splunk doing a pretty good job with the Common Information Model
read all the way here:
download the app here:
verify that the app ou download or build with the add-on builder are CIM complient
hope it helps
View solution in original post
This works, thank you !