Splunk Enterprise Security

Can you help with an Issue merging identities from two lookup tables in Enterprise Security?

ehowardl3
Path Finder

I have identity information I am pulling from two different sources in two different lookup tables. One lookup table has most of the identity columns populated, except for the "nick" column. The other lookup table has only the "email" and "nick" columns populated.

My expectation was that when the identity merge happens, I would only have one identity per email, and that identity would have all of the identity columns populated, including the "nick" field.

What actually happens is I get two separate identities per email address, with each identity only containing the information from its respective lookup table.

Is this expected behavior?

Thanks,
Eric

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

That is expected. Unfortunately... ES does not expect you to have duplicate identities in multiple tables. It doesn't "merge" identities well. It really merges sources. It expects you to have a row per identity. You should use your second lookup to fixup the first before feeding the combined result to ES.

The identity and asset system in ES is in need of updating to handle things like you describe gracefully. So for now it is better you do the touch up before feeding it to ES.

View solution in original post

starcher
SplunkTrust
SplunkTrust

That is expected. Unfortunately... ES does not expect you to have duplicate identities in multiple tables. It doesn't "merge" identities well. It really merges sources. It expects you to have a row per identity. You should use your second lookup to fixup the first before feeding the combined result to ES.

The identity and asset system in ES is in need of updating to handle things like you describe gracefully. So for now it is better you do the touch up before feeding it to ES.

ehowardl3
Path Finder

Thanks, for the response, that's what I was afraid of...

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...