Splunk Enterprise Security

How to add a custom field in an asset table?

slah
Observer

Hi, I have encoutered problem regarding adding a custom field to an asset table. I have followed a series of articles published on Splunk blog:

Asset & Identity for Splunk Enterprise Security - Part 1: Contextualizing Systems 

Asset & Identity for Splunk Enterprise Security - Part 2: Adding Additional Attributes to Assets 

Asset & Identity for Splunk Enterprise Security - Part 3: Empowering Analysts with More Attributes i... 

 

and read Splunk documentation on this topic.  But for some reason it doesn't work and I don't know how to debug it anymore , thus I am looking for tips on how to troubleshoot this issue.

I am sure the ES has access to the asset table, since values of default columns are added into notable index, when a correlation search generates a notable event. The enrichment for assets works but it somehow ignores custom columns in the asset table, even though the custom field is specified in Asset Fields tab in ES.

 

Version of ES:  6.6.2

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...