I think we aren't clear on exactly how the UID lookups would work. In our environment, we have hundreds of Linux boxes with individual (local) accounts (i.e. not federated, Kerberos, LDAPS, etc.). The lookups for the UID appear to be from a table built within the search head, which in our case is some random AWS box that lives in Splunk Cloud, as we are a hosted environment. How then would UID lookups ever work, if UID's greatly vary across boxes? Would we install the app on all of the Linux Universal Forwarders and then populate a lookup table based on /etc/passwd on each box? Or, if this won't work, is there a way to simply hide that field extraction such that it doesn't show up?
I think we aren't clear on exactly how the UID lookups would work. In our environment, we have hundreds of Linux boxes with individual (local) accounts (i.e. not federated, Kerberos, LDAPS, etc.). The lookups for the UID appear to be from a table built within the search head, which in our case is some random AWS box that lives in Splunk Cloud, as we are a hosted environment. How then would UID lookups ever work, if UID's greatly vary across boxes? Would we install the app on all of the Linux Universal Forwarders and then populate a lookup table based on /etc/passwd on each box? Or, if this won't work, is there a way to simply hide that field extraction such that it doesn't show up?