Splunk Enterprise Security

How to add a custom field in an asset table?

slah
Observer

Hi, I have encoutered problem regarding adding a custom field to an asset table. I have followed a series of articles published on Splunk blog:

Asset & Identity for Splunk Enterprise Security - Part 1: Contextualizing Systems 

Asset & Identity for Splunk Enterprise Security - Part 2: Adding Additional Attributes to Assets 

Asset & Identity for Splunk Enterprise Security - Part 3: Empowering Analysts with More Attributes i... 

 

and read Splunk documentation on this topic.  But for some reason it doesn't work and I don't know how to debug it anymore , thus I am looking for tips on how to troubleshoot this issue.

I am sure the ES has access to the asset table, since values of default columns are added into notable index, when a correlation search generates a notable event. The enrichment for assets works but it somehow ignores custom columns in the asset table, even though the custom field is specified in Asset Fields tab in ES.

 

Version of ES:  6.6.2

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...