Splunk Search

How to translate SID to Username via the Lookup Table?

Kendo213
Communicator

I have a lookup file which contains various fields, including the username and corresponding SID (pulled from AD).

I have a Windows event with data showing as User=NOT_TRANSLATED and Sid=(a value)

The CSV file contains a field named User and a field named Sid that matches.

I'm wanting to reference the lookup table to identify the username of the sid that is in the event data.

There is is where I am, and obviously it isn't working:

index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511  [| inputlookup ldap_identities.csv |  fields Sid,identity] | eval User=identity |  stats count by Sid,User

Any ideas?

0 Karma
1 Solution

Kendo213
Communicator

I figured this out:

index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 | lookup ldap_identities.csv Sid OUTPUT identity | rename identity as User | stats count by User,Sid,host

View solution in original post

0 Karma

bgriffis
Explorer

How did you get the Sid/Username lookup?

0 Karma

Kendo213
Communicator

I figured this out:

index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 | lookup ldap_identities.csv Sid OUTPUT identity | rename identity as User | stats count by User,Sid,host

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...