https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-Asset-and-Identity-configuration/m-p/593857#M10743 <P>I have 2 sourcetype <STRONG>WinHostMon</STRONG> and <STRONG>wineventlog</STRONG> with <STRONG>Splunk add-on for Microsoft windows</STRONG>. After doing Asset and Identity configuration in Splunk ES. the lookup file is fine and I can see the results with the search command:</P> <LI-CODE lang="markup">| inputlookup test_assets2.csv</LI-CODE> <P><BR />and <STRONG>Asset Lookup</STRONG> information is also displayed in <STRONG>ES &gt; Security Domains &gt; Identity &gt; Asset Center</STRONG> dashboard.<BR />But there is a problem that the enrichment fields for data like <STRONG>dest_asset, dest_asset_id, ...</STRONG> only appear in the <STRONG>WinHostMon </STRONG>sourcetype. Can someone help me pls?<BR />Thank you very much!</P> Fri, 15 Apr 2022 16:01:14 GMT hieuba6868 2022-04-15T16:01:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-Asset-and-Identity-configuration/m-p/593857#M10743 <P>I have 2 sourcetype <STRONG>WinHostMon</STRONG> and <STRONG>wineventlog</STRONG> with <STRONG>Splunk add-on for Microsoft windows</STRONG>. After doing Asset and Identity configuration in Splunk ES. the lookup file is fine and I can see the results with the search command:</P> <LI-CODE lang="markup">| inputlookup test_assets2.csv</LI-CODE> <P><BR />and <STRONG>Asset Lookup</STRONG> information is also displayed in <STRONG>ES &gt; Security Domains &gt; Identity &gt; Asset Center</STRONG> dashboard.<BR />But there is a problem that the enrichment fields for data like <STRONG>dest_asset, dest_asset_id, ...</STRONG> only appear in the <STRONG>WinHostMon </STRONG>sourcetype. Can someone help me pls?<BR />Thank you very much!</P> Fri, 15 Apr 2022 16:01:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-Asset-and-Identity-configuration/m-p/593857#M10743 hieuba6868 2022-04-15T16:01:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-Asset-and-Identity-configuration/m-p/594204#M10760 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/244933">@hieuba6868</a>&nbsp;,<BR /><BR />Write your first part of search to fetch from WinHostMon sourcetype and later on using a common denominator field write a stats command to correlate the information from lookup/wineventlog.<BR />Or you can write a join query to fetch data from the 2 sourcetypes, whichever one is feasible and not resource taxing.</P> Tue, 19 Apr 2022 07:30:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-Asset-and-Identity-configuration/m-p/594204#M10760 Gr0und_Z3r0 2022-04-19T07:30:02Z