Splunk Enterprise Security

Why is every single piece of text in identity_lookup_expanded lowercased?

gabriel_vasseur
Contributor

We upgraded to enterprise security 6.0.2 and now every single piece of text in identity_lookup_expanded is lowercased.

For instance, instead of having 'first' be "Gabriel" it's now "gabriel". Does this for every single fields, including job title ('category') etc.

How can I fix it?

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @gabriel_vasseur,

If case-sensitive matching disabled, the merge process converts all values to lowercase. You should enable case sensitivity on Identity Settings. You can see below documentation. The same mechanism works for assets also.

https://docs.splunk.com/Documentation/ES/6.0.2/Admin/Manageassetsandidentities#Enable_case-sensitive...

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @gabriel_vasseur,

If case-sensitive matching disabled, the merge process converts all values to lowercase. You should enable case sensitivity on Identity Settings. You can see below documentation. The same mechanism works for assets also.

https://docs.splunk.com/Documentation/ES/6.0.2/Admin/Manageassetsandidentities#Enable_case-sensitive...

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

gabriel_vasseur
Contributor

I did try that before and it doesn't help. I had another go today and it only works with these extra steps:

run "| outputlookup identity_lookup_expanded" to obliterate the old content.
open in search the identity merge search preview, and run it with "| outputlookup identity_lookup_expanded" added at the end. I don't understand why these extra steps are needed.

And then of course, I had to change the way we ingest identities and the lookup macro casing is consistent for usernames and email addresses.

On top of that, I have a lot of problem with identity merging search. entity_merge doesn't seem to work correctly and consistently and sometimes returns much fewer results than it should. I have no confidence in this framework now.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...