Splunk Enterprise Security

asset_lookup_by_str keeps changing the number of results

Path Finder

Hello Experts,
Currently I have configured 2 source files for Asset Center and also have configured searches for those to run once in a day for last 24 hr

I have set the global settings to wait between each identity manager run to 24 hrs(86400) as well.

What i understood that once Identity manager modular inputs detects changed size of source file and changed updated time then it will dispatch the custom search and initiate merging process. Then once data is been merged asset center shows only updated values.

My expectations are source file should run only once in a day and identity manager should merge all the data once in day only.
And I should always be able to see all the data with updated changes in Asset Center.

Could you please let me know what actions I should take to achieve this

Thanks in Advance

Labels (2)
0 Karma

Splunk Employee
Splunk Employee

What version of ES / Core are you running?

There should be no reason to slow down the identitiy_manager modular input.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...