Disable identitymerge in older enterprise security?

[gabriel_vasseur]

I am aware of this https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Merge however, we have a version of ES older than 6.4 and that feature does not exist there.

The behaviour of identitymerge is really unhelpful and has been causing many headaches. Is there a way to turn it off?

[lkutch_splunk]

Hi! How old is the ES version? I'm going to say at least 6.0 because that's when merge behavior changed. In versions of ES earlier than 6.0, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead. Disable merge was introduced in 6.2.0. 

But I only know of this doc section to avoid merging prior to 6.2.0 (using a 6.1.0 doc example... starting below the tables that happen to mention 6.2 for disabling it): 
https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Manageassetsandidentititiesuponupgrade#Avoid_me... 

Let me know if that helps.  

[gabriel_vasseur]

Yes, ES 6.0.

The problem we have arises when people leave the company and come back later, which happens regularly, especially for contractors. Even if they are given a brand new account and brand new employee number, as they should, if they have the same email address identitymerge will merge the two entries. So suddenly we have employees who exist but splunk thinks they have an endDate in the past.

And we want to keep the old entry in identities, as it's useful to check activity from expired accounts or when investigating old events.

Splunk didn't think this through obviously.
I worked around this issue by massaging the data before ES ingests it.

[lkutch_splunk]

Some new features come along in a later release that could help. But they're not available yet in 6.0:  

You can put the duplicates in different entity zones:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Globalsettings#Enable_entity_zones_for_Assets_o...

You can change the key to a different field for the merge:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Assetsettings#Add_or_edit_an_asset_field