Splunk Search

Static map of user ID with user name

nuwan
New Member

A finger print server log generates a user ID. Active directory log has user name. I have excel sheet for the user ID to user name mapping.
Could I use splunk to create a static table to map user ID with user name .basically my need is if the user is on leave ( no log on the finger print server) then if some one uses his password to acess active directory an incident should be created.

Could this be achieved in splunk.

Thank you in advance

Tags (1)
0 Karma

lguinn2
Legend

Yes. Save your spreadsheet as a comma-separated values file (CSV), then load it into Splunk as a lookup table. Here is the documentation: Create and Configure Field Lookups. Be sure to set the advanced options, so that you return a value (such as "Unknown") if there is no match in the lookup table.

Assuming the following names:

  • id_lookup - the name of the lookup you created
  • fingerprint.log
  • userId (for the field in the fingerprint.log and the id_lookup)
  • WinEvent:Security - the sourcetype of the active directory log
  • userName (for the field in the active directory log and the id_lookup)

The following search will return any events that have a userName that is not in the lookup table.

sourcetype=WinEvent::Security | lookup id_lookup userName OUTPUT userId | where userId="Unknown"

This search does not access the fingerprint.log; I don't think it needs to, but perhaps I do not understand the question fully.

0 Karma

nuwan
New Member

Thank you. I will try this and get back to you.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...