https://live.paloaltonetworks.com/t5/general-topics/source-of-user-id-data/m-p/583261#M116597 <P>I'm troubleshooting what appears to be an issue with user-id. I want to confirm I'm identifying the correct Window Event Logs the User-ID Agent captures to populate the User-ID data. I'm reviewing the logs in Splunk, so the source is shows as WinEventLog:Security. It of course contains the source IP, username, and a message indcating a logon event occurred. These logs aren't occurring for one particular user, so I want to make sure I'm not missing another source of the data.</P> Wed, 10 Apr 2024 17:39:27 GMT giapperreault 2024-04-10T17:39:27Z https://live.paloaltonetworks.com/t5/general-topics/source-of-user-id-data/m-p/583261#M116597 <P>I'm troubleshooting what appears to be an issue with user-id. I want to confirm I'm identifying the correct Window Event Logs the User-ID Agent captures to populate the User-ID data. I'm reviewing the logs in Splunk, so the source is shows as WinEventLog:Security. It of course contains the source IP, username, and a message indcating a logon event occurred. These logs aren't occurring for one particular user, so I want to make sure I'm not missing another source of the data.</P> Wed, 10 Apr 2024 17:39:27 GMT https://live.paloaltonetworks.com/t5/general-topics/source-of-user-id-data/m-p/583261#M116597 giapperreault 2024-04-10T17:39:27Z https://live.paloaltonetworks.com/t5/general-topics/source-of-user-id-data/m-p/583420#M116630 <P>If it's "one particular user" then it's probably something with the one user/PC and not a your config issue.</P> Thu, 11 Apr 2024 18:59:44 GMT https://live.paloaltonetworks.com/t5/general-topics/source-of-user-id-data/m-p/583420#M116630 Brandon_Wertz 2024-04-11T18:59:44Z