Splunk Enterprise Security - How do you add asset fields in new search automatically?

[joonoyang]

Hi,

I'm working on adding new data in CIM and putting tags in Communication and network with required fields. Of course, we have proper assets and other data types pull the info well.

I also expect to view asset fields when searching for new data but none are shown. Is there any other way to have assets fields automatically?

Tags: network and communication
Fields:
src_ip
dest_ip
dest_port
src_port
..,

Thanks in advance.

[starcher]

The asset autolookups in ES occur on dest, src, dvc etc not on dest_ip. Make sure you coalesce it field alias your fields like src_ip, src_host into src.