Splunk Search

Static map of user ID with user name

nuwan
New Member

A finger print server log generates a user ID. Active directory log has user name. I have excel sheet for the user ID to user name mapping.
Could I use splunk to create a static table to map user ID with user name .basically my need is if the user is on leave ( no log on the finger print server) then if some one uses his password to acess active directory an incident should be created.

Could this be achieved in splunk.

Thank you in advance

Tags (1)
0 Karma

lguinn2
Legend

Yes. Save your spreadsheet as a comma-separated values file (CSV), then load it into Splunk as a lookup table. Here is the documentation: Create and Configure Field Lookups. Be sure to set the advanced options, so that you return a value (such as "Unknown") if there is no match in the lookup table.

Assuming the following names:

  • id_lookup - the name of the lookup you created
  • fingerprint.log
  • userId (for the field in the fingerprint.log and the id_lookup)
  • WinEvent:Security - the sourcetype of the active directory log
  • userName (for the field in the active directory log and the id_lookup)

The following search will return any events that have a userName that is not in the lookup table.

sourcetype=WinEvent::Security | lookup id_lookup userName OUTPUT userId | where userId="Unknown"

This search does not access the fingerprint.log; I don't think it needs to, but perhaps I do not understand the question fully.

0 Karma

nuwan
New Member

Thank you. I will try this and get back to you.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...