Where can I find Splunk field names for AD event ID fields ?

[fzuazo]

Greetings all,

As the title states where can I find the Splunk equivalent of AD event ID fields ?

For example in the Splunk for AD app; AccountName is mapped to src_user. I would like some master list with the mappings and the equivalents between AD and Splunk, if such a thing exists.

I have searched everywhere and can't find it.

Thanks.

[adonio · Accepted solution]

hello there,

i dont think a list exists however splunk doing a pretty good job with the Common Information Model
read all the way here:
http://docs.splunk.com/Documentation/CIM/4.11.0/User/Overview
download the app here:
https://splunkbase.splunk.com/app/1621/
verify that the app ou download or build with the add-on builder are CIM complient

hope it helps

[fzuazo]

This works, thank you !