- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Merging identity lookups fails
Hi Splunkers,
I have an issue merging two identity lookup files on ES. In particular, my first lookup file has rows like the below:
identity priority email
vagn low vag@gmail.com
The second lookup file looks like the below:
identity priority email
vagn critical vag@gmail.com
I would expect that when I run the "| inputlookup append=T identity_lookup_expanded | entitymerge identity " command I would have a result like the below, yet this doesn't happen.
identity priority email
vagn critical vag@gmail.com
low
Any ideas? I have enabled the multivalue field for the "priority" field already so it can hold more than one value but didn't help.
Regards,
Evang
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The "priority" field, by default is defined as single value field. I'm not sure why you would want this to be multivalued -- ideally you should use stats and eval to make it into a single value field.
If you want to change this to multivalued: Configure -> Asset and Identity Management -> Identify Fields -> priority -> Multivalue (check and save).