Splunk Enterprise

UserSID lookup


I have an index called ‘RDIIS’ with 4 fields named SourceIP , UserSID , DestIP and Host.
Important to know is that UserSID refers to the SID of an active directory user.
I also have a second index ‘ADdump’ with 2 fields UserSID and Username.

Can I combine somehow the two indexes and have this table, so that the UserSID gets associated with the wright Username?

“| Table _time , Host, SourceIP, DestIP , UserSID , Username “

Labels (1)
Tags (2)
0 Karma

Esteemed Legend

Like this:

(index="RDIIS" AND index="ADdump")
| stats values(*) AS * BY UserSID
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...