Non-corporate Web Uploads

[jamesbanday]

Why I can't  I see data on Splunk ES Non-corporate Web Uploads? When I click on the user, I get mariangelie.rodriguez+castellano is not a known identity.

[danielcj]

Hello @jamesbanday ,

The message "is not a known identity" is related to the Identities that are configured in the Splunk Enterprise Security, probably this user is not configured in the Identities lookup.

To configure Assets & Identities in Splunk Enterprise Security, use the following doc: https://docs.splunk.com/Documentation/ES/7.3.0/Admin/Addassetandidentitydata.

Also, you could check in Splunk if this identity exists using the identities macro:

| `identities`
| search identity=<NAME_IDENTITY>

Thanks.