Splunk Enterprise Security: How to construct an inputlookup search that will display ES identity information from their usernames?

[ttchorz]

I have a lookup with 461 usernames. I want to input the lookup to Splunk and display corresponding First and Last name from Splunk Enterprise Security Identities.

Any ideas how to construct that search?

|inputlookup users | `identities`

user
xxxx
yyyy
zzzz
...

[kiran331 · Accepted solution]

Try this one.

|inputlookup users.csv|fields user|eval user=lower(user)|join type=left user [datamodel("Identity_Management", "All_Identities")| drop_dm_object_name("All_Identities")|mvexpand identity|rename identity as user|eval user=lower(user)]|table user first last

[ttchorz]

the search was missing `` around drop_dm_object_name("All_Identities")

Corrected and run it but it does not populate first and last name.

[kiran331]

try updated one..

[ttchorz]

Kiran,

Apologies, I did not noticed the updated search.
It was great, producing expected results !

Thanks!