Splunk Enterprise Security

Asset and Identity management multi valued


Identity: 314 assets are currently exceeding the field limits set in the Asset and Identity Management page. Data truncation will occur unless the field limits are increased. Sources: [merge].

0 Karma


@inayath_khanin1   The above error indicates that during the asset merge process, you have one of the 'key' entries exceeding the multi-value limit setup in the AssetFields page under 'Asset and Identity managent' UI ( you can access  in the ES app via Configure -> Data enrichment -> Asset and Identity managent).  Look at the all the key fields and the multi-value limit. Additionally, you can also check something like this (pick up any field you want to test, e.g. ip which has a mv limit of 6 by default


|`assets` | eval my_mvcount = count(ip) | stats count by my_mvcount | where my_mvcount > 3


0 Karma

Ultra Champion

Check the lookup contents but you probably hit the issue with some changes after ES upgrade.

In my case I needed to disable merging identities because for some unknown reason it was creating a ridiculous lookup entries


If you have distributed environment, you might not be able to disable merge from webui.  Then you need to fiddle with inputs.conf from SA-IdentityManagement app to disable merge of particular set of assets or identities.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...