Splunk Enterprise Security

How to avoid mixng values of assets by 'entitymerge' command in ES


Hi Splunkers ,

any advice how to avoid mixng values in assets by entitymerge command?
I have 5 fileds marked as Multivalue (category, ip, mac) and sometimes it cause trouble like multiple assets mapped to all existing categories or multiple IP addresses, and thus incorrect notable events.
Do I understand correctly that I should mark fields as Multivalue if there might be several valuse (like 2 mac addresses for computer or several categories (router|network) ?
SE V7.3.3, Enterprise Security Version 6.0.1 Build 2

Splunk Employee
Splunk Employee

If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset or identity, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead. 

Upcoming versions have some features that might address your issue.

You can disable the merge:

You can put the duplicates in different entity zones:

You can change the key to a different field for the merge:

Take note of the following if/when you upgrade:

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...