Check out the "Short-lived Admin Accounts" use case in the Splunk Security Essentials app. ... View more

As @richgalloway  says, you would need to consult the lookup file that you have [ with priority assets], before finalizing them for asset/identity. Alternatively, as you know the assets that are critical/high/medium/low priority for you, you can do also something like  |ldapsearch ..... <your search to extract fields> | <format/change to the fields required by asset> | eval priority = < apply your logic to add priority for each asset or default to low> | outputlookup <your_org_assets.csv> However, if you have 2 lookup files  - i.e. one is the output of the ldapsearch and other is your list with priority, you could try to merge them using  [ appears to be new, i haven't tried, but should work ]- https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Overwritewithentitymerge  ... View more