Splunk Enterprise Security

SplunkES -Data Enrichment - Asset and Identity Management- How does the content update work?

restinlinux
Explorer

The changes of the data source are not immediately reflected and some old information remains for several minutes.

How the content updates works? cron ? or Or is each data source combined and returned with each inputlookup reference? 

Or this depend on the environment use.. Clustering?

e.g. whether synchronization between search heads takes time and a time lag exists in the reflection of the results.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You are correct.  Changes to assets and identities do not take effect immediately.  A set of saved search runs periodically to refresh the lists.  You can find the relevant searches by looking for "Asset * - Lookup Gen" and "Identity * - Lookup Gen"

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...