I have a lookup file which contains various fields, including the username and corresponding SID (pulled from AD).
I have a Windows event with data showing as User=NOT_TRANSLATED and Sid=(a value)
The CSV file contains a field named User and a field named Sid that matches.
I'm wanting to reference the lookup table to identify the username of the sid that is in the event data.
There is is where I am, and obviously it isn't working:
index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 [| inputlookup ldap_identities.csv | fields Sid,identity] | eval User=identity | stats count by Sid,User
I figured this out:
index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 | lookup ldap_identities.csv Sid OUTPUT identity | rename identity as User | stats count by User,Sid,host
View solution in original post
How did you get the Sid/Username lookup?