How to avoid mixng values of assets by 'entitymerge' command in ES

[evelenke]

Hi Splunkers ,

any advice how to avoid mixng values in assets by entitymerge command?
I have 5 fileds marked as Multivalue (category, ip, mac) and sometimes it cause trouble like multiple assets mapped to all existing categories or multiple IP addresses, and thus incorrect notable events.
Do I understand correctly that I should mark fields as Multivalue if there might be several valuse (like 2 mac addresses for computer or several categories (router|network) ?
SE V7.3.3, Enterprise Security Version 6.0.1 Build 2

[lkutch_splunk]

If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset or identity, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead. 

Upcoming versions have some features that might address your issue.

You can disable the merge:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Globalsettings#Enable_merge_for_assets_or_ident...

You can put the duplicates in different entity zones:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Globalsettings#Enable_entity_zones_for_Assets_o...

You can change the key to a different field for the merge:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

Take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Manageassetsandidentititiesuponupgrade