Splunk Search

Multiple email domains..

Brian_Osburn
Builder

I've upgraded from Version 1.01 to 1.1 today, and I'm having some issues around users with multiple email addresses.

For example, some parts of our company are using first.last@companyname1.com, while some of us are using firstinitallastname@companyname2.com.

Is there anyway to account for this in the application?

In addition, under client behavior - mailbox store overview, alot of the usernames are listed as @UNKNOWN..

Any help around this?

0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

You need to edit the domain_aliases.csv and active_directory.csv to account for the variance in the information. This is documented on http://docs.splunk.com

View solution in original post

ahall_splunk
Splunk Employee
Splunk Employee

You need to edit the domain_aliases.csv and active_directory.csv to account for the variance in the information. This is documented on http://docs.splunk.com

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...