topic Re: Identity information on a datamodel search in Splunk Enterprise

How to create Identity information on a datamodel search?

XavG_KS — Tue, 08 Aug 2023 16:37:06 GMT

Hi,

I just notice a strange behavior in Splunk Identity management and the datamodel.

Indeed, if I make a search based on "index + sourcetype", my results include all identity information when the user is known.

But when I execute the same search based on the datamodel (Web in my example), I only have the information that are specifically mention in the data model

I don't understand that behavior .. the goals of Splunk ES is to use the DM as much as we can't but we lose information...

What am I missing ?

How can I retrieve all the Identity (and Asset) information with a datamodel search ?

Thanks in advance

Xavier

Re: Identity information on a datamodel search

richgalloway — Tue, 08 Aug 2023 13:07:55 GMT

What you've experienced is normal. A data model can display only what is in the DM, just like a index search can display only what is in the index.

Combining data from a DM and an index (or multiple DMs or indexes) is called a correlation and is one of Splunk's reasons for being. Use the Web.user field to pull identity information.

Re: Identity information on a datamodel search

XavG_KS — Tue, 22 Aug 2023 08:56:41 GMT

Hi,

Thanks for the feedback.

Ok I get it but can you tell me "HOW" do I pull identity information from the Web.user field ?

Because one thing I don't understand is when you say "index search can display only what is in the index", it's wrong as in my example the search is index based BUT it also display user information FROM the asset & identity framework. Proof is in the log (so in the index) there is no information like managedBy, company, ...

The user's information integration is done automatically by the framework I supposed.

Re: Identity information on a datamodel search

richgalloway — Tue, 22 Aug 2023 12:30:18 GMT

In your example, data from the index is supplemented by data from lookup files. You can do the same with data from a data model.