Identity list fields enrichment not showing in a index?

[JLopez]

Hi Guys,

We use enterprise security and we have configured asset and identity list.  
From the global option "Asset and Identity Management" we have enabled merge asset and identities for all sourcetypes.

I can see the fields names (email,first,nick etc....) for most of indexers.

However for some reason I am unable to view my identity list fields names being populated when I search on a index I created 3 weeks ago. 

Can someone help me how to troubleshoot this ? 

[meetmshah · Accepted solution]

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

Please accept the answer if it helps you!