Splunk Enterprise Security

Identity list fields enrichment not showing in a index?

JLopez
Explorer

Hi Guys,

We use enterprise security and we have configured asset and identity list.  
From the global option "Asset and Identity Management" we have enabled merge asset and identities for all sourcetypes.

I can see the fields names (email,first,nick etc....) for most of indexers.

However for some reason I am unable to view my identity list fields names being populated when I search on a index I created 3 weeks ago. 

Can someone help me how to troubleshoot this ? 



0 Karma
1 Solution

meetmshah
Builder

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

 

Please accept the answer if it helps you!

View solution in original post

meetmshah
Builder

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

 

Please accept the answer if it helps you!

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...