Splunk Enterprise Security

Identity list fields enrichment not showing in a index?

JLopez
Explorer

Hi Guys,

We use enterprise security and we have configured asset and identity list.  
From the global option "Asset and Identity Management" we have enabled merge asset and identities for all sourcetypes.

I can see the fields names (email,first,nick etc....) for most of indexers.

However for some reason I am unable to view my identity list fields names being populated when I search on a index I created 3 weeks ago. 

Can someone help me how to troubleshoot this ? 



0 Karma
1 Solution

meetmshah
Builder

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

 

Please accept the answer if it helps you!

View solution in original post

meetmshah
Builder

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

 

Please accept the answer if it helps you!

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...