Why is every single piece of text in identity_lookup_expanded lowercased?

[gabriel_vasseur]

We upgraded to enterprise security 6.0.2 and now every single piece of text in identity_lookup_expanded is lowercased.

For instance, instead of having 'first' be "Gabriel" it's now "gabriel". Does this for every single fields, including job title ('category') etc.

How can I fix it?

[scelikok · Accepted solution]

Hi @gabriel_vasseur,

If case-sensitive matching disabled, the merge process converts all values to lowercase. You should enable case sensitivity on Identity Settings. You can see below documentation. The same mechanism works for assets also.

https://docs.splunk.com/Documentation/ES/6.0.2/Admin/Manageassetsandidentities#Enable_case-sensitive...

[gabriel_vasseur]

I did try that before and it doesn't help. I had another go today and it only works with these extra steps:

run "| outputlookup identity_lookup_expanded" to obliterate the old content.
open in search the identity merge search preview, and run it with "| outputlookup identity_lookup_expanded" added at the end. I don't understand why these extra steps are needed.

And then of course, I had to change the way we ingest identities and the lookup macro casing is consistent for usernames and email addresses.

On top of that, I have a lot of problem with identity merging search. entity_merge doesn't seem to work correctly and consistently and sometimes returns much fewer results than it should. I have no confidence in this framework now.