Splunk Enterprise Security

asset_lookup_by_str keeps changing the number of results

Path Finder

Hello Experts,
Currently I have configured 2 source files for Asset Center and also have configured searches for those to run once in a day for last 24 hr

I have set the global settings to wait between each identity manager run to 24 hrs(86400) as well.

What i understood that once Identity manager modular inputs detects changed size of source file and changed updated time then it will dispatch the custom search and initiate merging process. Then once data is been merged asset center shows only updated values.

My expectations are source file should run only once in a day and identity manager should merge all the data once in day only.
And I should always be able to see all the data with updated changes in Asset Center.

Could you please let me know what actions I should take to achieve this

Thanks in Advance

Labels (2)
0 Karma

Splunk Employee
Splunk Employee

What version of ES / Core are you running?

There should be no reason to slow down the identitiy_manager modular input.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...