Splunk Enterprise Security

asset_lookup_by_str keeps changing the number of results

Path Finder

Hello Experts,
Currently I have configured 2 source files for Asset Center and also have configured searches for those to run once in a day for last 24 hr

I have set the global settings to wait between each identity manager run to 24 hrs(86400) as well.

What i understood that once Identity manager modular inputs detects changed size of source file and changed updated time then it will dispatch the custom search and initiate merging process. Then once data is been merged asset center shows only updated values.

My expectations are source file should run only once in a day and identity manager should merge all the data once in day only.
And I should always be able to see all the data with updated changes in Asset Center.

Could you please let me know what actions I should take to achieve this

Thanks in Advance

Labels (2)
0 Karma

Splunk Employee
Splunk Employee

What version of ES / Core are you running?

There should be no reason to slow down the identitiy_manager modular input.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...