This is the search that merges identities, according to the search preview:
| inputlookup append=T "administrative_identity_lookup"
| fillnull value="administrative_identities" _source
| inputlookup append=T "simple_identity_lookup"
| fillnull value="static_identities" _source
| eval identity=split(identity, "|"),identity=if(_source=="administrative_identities", mvappend(identity,email,replace(email,"@.*","")), identity),identity=if(_source=="static_identities", mvappend(identity,email,replace(email,"@.*","")), identity),identity=mvjoin(mvdedup(identity), "|")
| table "_source","bunit","category","email","endDate","first","last","managedBy","nick","phone","prefix","priority","startDate","suffix","watchlist","work_city","work_country","work_lat","work_long","identity"
| eval `iden_mktime_meval(startDate)`,`iden_mktime_meval(endDate)`,identity=mvsort(identity)
| sort 0 +identity
| inputlookup append=T "identity_lookup_expanded"
| entitymerge "identity"
If identity_lookup_expanded is empty (because I've flushed it), it produces results. If I pipe these results into an "outputlookup identity_lookup_expanded" it is populating identity_lookup_expanded ok (except all text is lowercase, but see my other question regarding that). Now if I run the above search again, it returns no results. It's ok until it hist entitymerge.
What does this mean?
