Splunk Search

Static map of user ID with user name

New Member

A finger print server log generates a user ID. Active directory log has user name. I have excel sheet for the user ID to user name mapping.
Could I use splunk to create a static table to map user ID with user name .basically my need is if the user is on leave ( no log on the finger print server) then if some one uses his password to acess active directory an incident should be created.

Could this be achieved in splunk.

Thank you in advance

Tags (1)
0 Karma


Yes. Save your spreadsheet as a comma-separated values file (CSV), then load it into Splunk as a lookup table. Here is the documentation: Create and Configure Field Lookups. Be sure to set the advanced options, so that you return a value (such as "Unknown") if there is no match in the lookup table.

Assuming the following names:

  • id_lookup - the name of the lookup you created
  • fingerprint.log
  • userId (for the field in the fingerprint.log and the id_lookup)
  • WinEvent:Security - the sourcetype of the active directory log
  • userName (for the field in the active directory log and the id_lookup)

The following search will return any events that have a userName that is not in the lookup table.

sourcetype=WinEvent::Security | lookup id_lookup userName OUTPUT userId | where userId="Unknown"

This search does not access the fingerprint.log; I don't think it needs to, but perhaps I do not understand the question fully.

0 Karma

New Member

Thank you. I will try this and get back to you.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...