Getting Data In

How to get the correct gid/uid on windows fschange events

oreoshake
Communicator

All of my events show up with gid=-1,uid=-1. Is this a bug or am I doing something wrong?

Tags (2)
1 Solution

jrodman
Splunk Employee
Splunk Employee

Windows does not have a gid or uid, thus these fields come in as "unset". The equivalent concepts on Windows are owner and ACL list, which cannot be expressed as two numbers.

If we don't currently capture Owner, that's kind of a shame. It shouldn't be too difficult to put that in a field. ACL list is pretty tricksy as it can be arbitrarily complex. Should at least be an ER to capture that stuff.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

Windows does not have a gid or uid, thus these fields come in as "unset". The equivalent concepts on Windows are owner and ACL list, which cannot be expressed as two numbers.

If we don't currently capture Owner, that's kind of a shame. It shouldn't be too difficult to put that in a field. ACL list is pretty tricksy as it can be arbitrarily complex. Should at least be an ER to capture that stuff.

jrodman
Splunk Employee
Splunk Employee

If our marketing collateral is out of step with the hard requirements of compliance specifications, that definitely deserves to be addressed. Get the ball rolling with a support ticket. Eventually it becomes an internal discussion to get things sorted, I think, but you'd be doing us a favor to apply the lever.

0 Karma

oreoshake
Communicator

I agree!!! Or at least put asterisks on your compliance advertisements!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...