Where does the mapping of Account Name to src happ... - Splunk Community

Getting Data In

I'm not clear where and when the src field gets its value for the WinEventLog data.

This should be happening in the Splunk_TA_windows app. Check the props.conf and transforms.conf in the default directory.

HI danielbb,
This question doesn't seem a Splunk question, could you give more details?

Ciao.
Giuseppe

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...