+3
What do we advise customers when there is a change in theorganizational domain but the log consists of old domain. For example: the system are extracting logs linked to the old email address like @immunesecurity.com, but in AD it is @logpoint.com.
Best answer by Basudev Raut
View original
+7
Hi Rupsan,
Splitting user@immunesecurity.com to user=user and comparing it with the SAMAccountName in LDAP table may not work because the SAMAccountName and the value in user field may not be the same.
There are two ways to handle this problem.
| sender="*logpoint.com" | process eval("email=replace(sender,'@logpoint.com','@abc.com')") |
Already have an account? Login
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
