I also have this issue, has anyone found a working solution to this? I also noticed that this to be an issue with session_id in the tSessions lookup table.
I managed to work around it for the tsessions_update using mvindex(Login_ID,-1) and mvindex(Account_Domain,-1) for nt_login_domain, however I agree with mikaelbje, that this should be fixed within the Splunk Supported app.
I have opened a ticket with a few issues I have found within this app/spunk, and this issue is one of them.
I am running splunk 6.3.1 with 1.2.0 of the splunk_app__windows_infrastructure
... View more