Static map of user ID with user name

[nuwan]

A finger print server log generates a user ID. Active directory log has user name. I have excel sheet for the user ID to user name mapping.
Could I use splunk to create a static table to map user ID with user name .basically my need is if the user is on leave ( no log on the finger print server) then if some one uses his password to acess active directory an incident should be created.

Could this be achieved in splunk.

Thank you in advance

[lguinn2]

Yes. Save your spreadsheet as a comma-separated values file (CSV), then load it into Splunk as a lookup table. Here is the documentation: Create and Configure Field Lookups. Be sure to set the advanced options, so that you return a value (such as "Unknown") if there is no match in the lookup table.

Assuming the following names:

• id_lookup - the name of the lookup you created
• fingerprint.log
• userId (for the field in the fingerprint.log and the id_lookup)
• WinEvent:Security - the sourcetype of the active directory log
• userName (for the field in the active directory log and the id_lookup)

The following search will return any events that have a userName that is not in the lookup table.

sourcetype=WinEvent::Security | lookup id_lookup userName OUTPUT userId | where userId="Unknown"

This search does not access the fingerprint.log; I don't think it needs to, but perhaps I do not understand the question fully.

[nuwan]

Thank you. I will try this and get back to you.