Splunk Enterprise Security

When bringing in assets and identities to Splunk ES via an input is there any value in separating the lookups by domain?

lmmills
Explorer

When bringing in assets and identities to Splunk ES via an input is there any value in separating the lookups by domain?  When I bring in the identities from multiple sources the events are multivalue so one event may contain 5 usernames and 5 different domains.

Labels (3)
0 Karma
1 Solution

meetmshah
Builder

Hello @lmmills, It is suggested using multiple lookups for different domains / sources etc. as - 

  • There won't be single point of failure - meaning if one lookup file is accidentally deleted, we have other files available
  • Individual lookups can be updated through individual saved searches without touching other lookups

If you have multiple domains and which can contain multiple usernames, you can add additional custom field and make it "key" field. So that merging will be in place based on that additional field.

 

Feel free to accept the answer if that helps!

View solution in original post

meetmshah
Builder

Hello @lmmills, It is suggested using multiple lookups for different domains / sources etc. as - 

  • There won't be single point of failure - meaning if one lookup file is accidentally deleted, we have other files available
  • Individual lookups can be updated through individual saved searches without touching other lookups

If you have multiple domains and which can contain multiple usernames, you can add additional custom field and make it "key" field. So that merging will be in place based on that additional field.

 

Feel free to accept the answer if that helps!

Get Updates on the Splunk Community!

Video | Welcome Back to Smartness, Pedro

Remember Splunk Community member, Pedro Borges? If you tuned into Episode 2 of our Smartness interview series, ...

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...