Hi, I have encoutered problem regarding adding a custom field to an asset table. I have followed a series of articles published on Splunk blog:
- Asset & Identity for Splunk Enterprise Security - Part 1: Contextualizing Systems
- Asset & Identity for Splunk Enterprise Security - Part 2: Adding Additional Attributes to Assets
- Asset & Identity for Splunk Enterprise Security - Part 3: Empowering Analysts with More Attributes i...
and read Splunk documentation on this topic. But for some reason it doesn't work and I don't know how to debug it anymore , thus I am looking for tips on how to troubleshoot this issue.
I am sure the ES has access to the asset table, since values of default columns are added into notable index, when a correlation search generates a notable event. The enrichment for assets works but it somehow ignores custom columns in the asset table, even though the custom field is specified in Asset Fields tab in ES.
Version of ES: 6.6.2
