Adding Enterprise Security Identity data to a Splunk result set

cbschreiber — Thu, 08 Apr 2021 18:49:11 GMT

I have a really simple query that I'd like to join with Enterprise Security's Identity data.

In this case, simply grab the user from a Palo Alto system log, cross reference the user with ES Identity lookup and grab the priority field for that user. Simple right??

Here is the SPL I've tried:

But nothing populates the priority field. Also tried:

index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*")
| lookup es_identity_lookup identity AS user OUTPUT priority
| table _time user priority

But this doesn't even run. Throws an error.

Any help here would be most appreciated! Thanks in advance.

topic Adding Enterprise Security Identity data to a Splunk result set in Security

Adding Enterprise Security Identity data to a Splunk result set