I'm having a challenge with the EMC Isilon Splunk App and Add-on that is reporting the SID information but not translating it to user/domain. There's not much in the way of directions for these and it seems like I missed a configuration step.
There are no errors being thrown and the index is taking in syslog information.
What do I need to do to get the FS Audit Logs to translate the user SID?
Thanks!
