All Apps and Add-ons

From exchange apps, there is a lookup ad_username that normalizes the logon name format, any example to show how it works.

daniel_splunk
Splunk Employee
Splunk Employee

From exchange apps, there is a lookup ad_username that normalizes the logon name format, any example to show how it works.

0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

After install the splunk apps for microsoft exchange without any special customerization, Splunk have the following login username translation behavior.

    google\peter@google  >>> peter@google
    google/peter@google  >>> peter@google
    google\peter         >>> peter@google
    google/peter         >>> peter@google
    mary@yahoo           >>> mary@yahoo
    daniel               >>> daniel@UNKNOWN

From the above example, if the login username don't have domain, it will default to UNKNOWN.
This behavior can be changed by using domain_aliases.csv (under splunk_app_microsoft/exchange/local directory)

# cat domain_aliases.csv
UNKNOWN,LF-main.com
google,google-private-cloud.com

Once we add the above domain_aliases.csv, the login username translation become:

google/peter@google      >>> peter@google-private-cloud.com
daniel                   >>> daniel@LF-main.com

Now, we know how to change from one domain to another domain.
Splunk is also capable to append different domain to username provided that you know beforehand.

For example, if I want to make the following username login translation.

dragon       >>> dragon@china.com
jellyfish    >>> jellyfish@hongkong.com
lion         >>> animal@forest.com

You can do this by using the active_directory.csv file. Here is the setting.

# cat active_directory.csv
china.com,dragon,dragon
hongkong.com,jellyfish,jellyfish
forest.com,animal,lion

Finally, this is the search that you can use to quickly test and see the result.

index=_internal|head 1|eval cs_username = "lion"|lookup ad_username cs_username|table cs_username, user_subject

alt text

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...