Splunk Enterprise Security

Can you help with an Issue merging identities from two lookup tables in Enterprise Security?

ehowardl3
Path Finder

I have identity information I am pulling from two different sources in two different lookup tables. One lookup table has most of the identity columns populated, except for the "nick" column. The other lookup table has only the "email" and "nick" columns populated.

My expectation was that when the identity merge happens, I would only have one identity per email, and that identity would have all of the identity columns populated, including the "nick" field.

What actually happens is I get two separate identities per email address, with each identity only containing the information from its respective lookup table.

Is this expected behavior?

Thanks,
Eric

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

That is expected. Unfortunately... ES does not expect you to have duplicate identities in multiple tables. It doesn't "merge" identities well. It really merges sources. It expects you to have a row per identity. You should use your second lookup to fixup the first before feeding the combined result to ES.

The identity and asset system in ES is in need of updating to handle things like you describe gracefully. So for now it is better you do the touch up before feeding it to ES.

View solution in original post

starcher
SplunkTrust
SplunkTrust

That is expected. Unfortunately... ES does not expect you to have duplicate identities in multiple tables. It doesn't "merge" identities well. It really merges sources. It expects you to have a row per identity. You should use your second lookup to fixup the first before feeding the combined result to ES.

The identity and asset system in ES is in need of updating to handle things like you describe gracefully. So for now it is better you do the touch up before feeding it to ES.

ehowardl3
Path Finder

Thanks, for the response, that's what I was afraid of...

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...