Resolving UID to POSIX username

[BeanBagKing]

I think we aren't clear on exactly how the UID lookups would work. In our environment, we have hundreds of Linux boxes with individual (local) accounts (i.e. not federated, Kerberos, LDAPS, etc.). The lookups for the UID appear to be from a table built within the search head, which in our case is some random AWS box that lives in Splunk Cloud, as we are a hosted environment. How then would UID lookups ever work, if UID's greatly vary across boxes? Would we install the app on all of the Linux Universal Forwarders and then populate a lookup table based on /etc/passwd on each box? Or, if this won't work, is there a way to simply hide that field extraction such that it doesn't show up?

[SmoothlOperator]

It is confusing for me also, will this ever work in environments with local accounts that are not centrally managed? Wouldn't it be beneficial to include hostname in learnt_posix_identities collection?