Monitoring Splunk

Isilon FS Audit Logs Shows No User - Searching Index Shows SID

travismartinez
New Member

I'm having a challenge with the EMC Isilon Splunk App and Add-on that is reporting the SID information but not translating it to user/domain. There's not much in the way of directions for these and it seems like I missed a configuration step.

There are no errors being thrown and the index is taking in syslog information.

What do I need to do to get the FS Audit Logs to translate the user SID?

Thanks!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!