Splunk Enterprise Security

Identity list fields enrichment not showing in a index?

JLopez
Explorer

Hi Guys,

We use enterprise security and we have configured asset and identity list.  
From the global option "Asset and Identity Management" we have enabled merge asset and identities for all sourcetypes.

I can see the fields names (email,first,nick etc....) for most of indexers.

However for some reason I am unable to view my identity list fields names being populated when I search on a index I created 3 weeks ago. 

Can someone help me how to troubleshoot this ? 



0 Karma
1 Solution

meetmshah
Builder

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

 

Please accept the answer if it helps you!

View solution in original post

meetmshah
Builder

Hello,

Those fields are being populated by automated lookups from SA-IdentityManagement. Can you please verify - 

- If you have SA-IdentityManagement automated lookups enabled? (Got to Lookups -> Automated Lookups -> Select "SA-IdentityManagement" and check if 11 lookups are enabled or not

- Validate if you have fields like dest, src, src_user, user etc are available in the event itself. Because if not, it will not be able to consider the same is input and will not populate any additional fields.

 

Please accept the answer if it helps you!

Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...