How to write Asset and Identity configuration?

[hieuba6868]

I have 2 sourcetype WinHostMon and wineventlog with Splunk add-on for Microsoft windows. After doing Asset and Identity configuration in Splunk ES. the lookup file is fine and I can see the results with the search command:

| inputlookup test_assets2.csv

and Asset Lookup information is also displayed in ES > Security Domains > Identity > Asset Center dashboard.
But there is a problem that the enrichment fields for data like dest_asset, dest_asset_id, ... only appear in the WinHostMon sourcetype. Can someone help me pls?
Thank you very much!

[Gr0und_Z3r0]

Hi @hieuba6868 ,

Write your first part of search to fetch from WinHostMon sourcetype and later on using a common denominator field write a stats command to correlate the information from lookup/wineventlog.
Or you can write a join query to fetch data from the 2 sourcetypes, whichever one is feasible and not resource taxing.