Splunk Enterprise Security

Merging identity lookups fails

vagnet
Explorer

Hi Splunkers,

I have an issue merging two identity lookup files on ES. In particular, my first lookup file has rows like the below:

 

identity	priority	email
vagn		low	        vag@gmail.com

 

The second lookup file looks like the below:

 

identity	priority	email
vagn		critical	vag@gmail.com

 

I would expect that when I run the "| inputlookup append=T identity_lookup_expanded | entitymerge identity " command I would have a result like the below, yet this doesn't happen.

 

identity	priority	email
vagn		critical	vag@gmail.com
			low

 

Any ideas? I have enabled the multivalue field for the "priority" field already so it can hold more than one value but didn't help.

 

Regards,

Evang

 

Labels (2)
Tags (3)
0 Karma

johnhuang
Motivator

The "priority" field, by default is defined as single value field. I'm not sure why you would want this to be multivalued -- ideally you should use stats and eval to make it into a single value field.

If you want to change this to multivalued: Configure -> Asset and Identity Management -> Identify Fields -> priority -> Multivalue (check and save).

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...