Getting Data In

How do you assign host value for ActiveDirectory source?

Jason_1
New Member

I have the 4.2 universal forwarder installed on an Active Directory DC, but have been unable to assign the fqdn as the host value for ActiveDirectory (splunk-admon) events. Setting host=fqdn in inputs.conf sets the correct host value for WinEventLog and WMI events, but not for ActiveDirectory. Tried setting host=fdqn in admon.conf but did not have any effect. Also tried the following transform but still had no effect...

$splunkhome/etc/system/local/props.conf

[ActiveDirectory] 
TRANSFORMS-rowandc = rowandc-host

$splunkhome/etc/system/local/transforms.conf

[rowandc-host]
DEST_KEY = MetaData:Host
REGEX = dcName=(\w*\.rowanads\.rowan\.edu)
FORMAT = host::$1

Sample data...

03/18/2011 11:25:50.073
dcName=ads4.rowanads.rowan.edu
admonEventType=Deleted
objectGuid=removed
distinguishedName=removed
host=ADS4      sourcetype=ActiveDirectory      source=ActiveDirectory
Tags (1)
0 Karma

woodcock
Esteemed Legend

That should work but you will need to restart every Indexer first (which you probably did not do). I would also use something like this instead of what you are using:

REGEX = dcName=(.*)[\r\n]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...