Splunk Enterprise Security

App for Enterprise Security error: lookup_expander: Some extra fields were present in the input CSV

jaoui
Path Finder

The messages at the top of the screen populates with the following error:
lookup_expander: Some extra fields were present in the input CSV

I want to keep the extra fields in my lookup but I don't want my users to see the error message

Any ideas on what I should do?

0 Karma

jervin_splunk
Splunk Employee
Splunk Employee

Custom fields in asset and/or identity tables were prohibited by design beginning in Enterprise Security 2.2, which contained performance optimizations for asset and identity correlation.

However, we now have a patch that provides custom field support for Enterprise Security 2.4. To obtain it you should contact Support to open a case. Provide your exact Splunk and app version information, and we should be able to help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...