Splunk Enterprise Security

Splunk ES : macro get_identity4events not returning values from identity in notables

lakshman239
Influencer

Greetings

we have the following versions : Splunk 6.5.2/ES 4.5.0/CIM 4.6.0

When we use the macro on its own in the search, it links and shows expected results. Also, when we use the same correlation search on the search bar [ within ES or general search], it works. However, as part of notable event, it doesn't link to identity and doesn't display the user_first, user_last etc..

Has anyone seen the following issue with the macro? Any pointers?

| makeresults | eval user="VanHelsing" | get_identity4events(user) - works

|datamodel(...) | get_identity4events(user) --works

| .... in correlation search /notable doesn't display all the fields from the identity for that particular user.

Thanks
Laks

0 Karma
1 Solution

lakshman239
Influencer

Answering my questions.

For any fields to be available and visible in the incident review screens, it needs to be in /etc/apps/SA-ThreatIntelligence/default/log_review.conf. In the above case, fields like src_user_first, src_user_last are not present and hence they weren't available. So, if we add them in the local/log_review.conf or via GUI (Configure->Incident Management->Incident Review Settings), it works.

View solution in original post

0 Karma

lakshman239
Influencer

Answering my questions.

For any fields to be available and visible in the incident review screens, it needs to be in /etc/apps/SA-ThreatIntelligence/default/log_review.conf. In the above case, fields like src_user_first, src_user_last are not present and hence they weren't available. So, if we add them in the local/log_review.conf or via GUI (Configure->Incident Management->Incident Review Settings), it works.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...