Splunk Enterprise Security

How to add a custom field in an asset table?

slah
Observer

Hi, I have encoutered problem regarding adding a custom field to an asset table. I have followed a series of articles published on Splunk blog:

Asset & Identity for Splunk Enterprise Security - Part 1: Contextualizing Systems 

Asset & Identity for Splunk Enterprise Security - Part 2: Adding Additional Attributes to Assets 

Asset & Identity for Splunk Enterprise Security - Part 3: Empowering Analysts with More Attributes i... 

 

and read Splunk documentation on this topic.  But for some reason it doesn't work and I don't know how to debug it anymore , thus I am looking for tips on how to troubleshoot this issue.

I am sure the ES has access to the asset table, since values of default columns are added into notable index, when a correlation search generates a notable event. The enrichment for assets works but it somehow ignores custom columns in the asset table, even though the custom field is specified in Asset Fields tab in ES.

 

Version of ES:  6.6.2

Labels (2)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...