Splunk Enterprise Security

Identity list fields enrichment not showing in a index?

JLopez
Explorer

Hi Guys,

We use enterprise security and we have configured asset and identity list.  
From the global option "Asset and Identity Management" we have enabled merge asset and identities for all sourcetypes.

I can see the fields names (email,first,nick etc....) for most of indexers.

However for some reason I am unable to view my identity list fields names being populated when I search on a index I created 3 weeks ago. 

Can someone help me how to troubleshoot this ? 



0 Karma
1 Solution

meetmshah
Contributor

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

 

Please accept the answer if it helps you!

View solution in original post

meetmshah
Contributor

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

 

Please accept the answer if it helps you!

Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...