How to create Identity information on a datamodel search?

[XavG_KS]

Hi,

I just notice a strange behavior in Splunk Identity management and the datamodel. 

Indeed, if I make a search based on "index + sourcetype", my results include all identity information when the user is known.

But when I execute the same search based on the datamodel (Web in my example), I only have the information that are specifically mention in the data model

I don't understand that behavior .. the goals of Splunk ES is to use the DM as much as we can't but we lose information...

What am I missing ? 

How can I retrieve all the Identity (and Asset) information with a datamodel search ? 

Thanks in advance

Xavier

[richgalloway]

What you've experienced is normal.  A data model can display only what is in the DM, just like a index search can display only what is in the index.

Combining data from a DM and an index (or multiple DMs or indexes) is called a correlation and is one of Splunk's reasons for being.  Use the Web.user field to pull identity information.

[XavG_KS]

Hi, 

Thanks for the feedback. 

Ok I get it but can you tell me "HOW" do I pull identity information from the Web.user field ? 

Because one thing I don't understand is when you say "index search can display only what is in the index", it's wrong as in my example the search is index based BUT it also display user information FROM the asset & identity framework.  Proof is in the log (so in the index) there is no information like managedBy, company, ...

The user's information integration is done automatically by the framework I supposed.

[richgalloway]

In your example, data from the index is supplemented by data from lookup files.  You can do the same with data from a data model.