As stated in the title, I'm looking for someone tell the differences between the field user and src_user in the CIM Model Change Analysis (All_Change.Account_Management). The definitions in Splunk document are not clear enough. For example, when the user user_A reset the password for user user_B, I can see the following message in the logs 2016-05-24, 11:25:33.001, Account, "Password Reset", "[Dummy-0] [user:user_A ip:10.1.1.1 group:admin] Update the password of user user_B." In this case, for user_A, shall I map it to field src_user or field user? For user_B account shall I map it to CIM field "user" or field "object"? ... View more