Do you see the SID reported in those events?
If so, it may be that you do not have evt_resolve_ad_obj = 1 set on the inputs.conf stanza for the security event log.
This setting will force the Splunk UF to try to resolve the SID to a user account
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Windows_Event_Log_Monitor
See this post, where I made a few suggestions on how to address this
https://answers.splunk.com/answers/732772/why-are-user-details-missing-in-the-splunk-logs.html#answer-731902
... View more