@inayath_khanin1   The above error indicates that during the asset merge process, you have one of the 'key' entries exceeding the multi-value limit setup in the AssetFields page under 'Asset and Identity managent' UI ( you can access  in the ES app via Configure -> Data enrichment -> Asset and Identity managent).  Look at the all the key fields and the multi-value limit. Additionally, you can also check something like this (pick up any field you want to test, e.g. ip which has a mv limit of 6 by default   |`assets` | eval my_mvcount = count(ip) | stats count by my_mvcount | where my_mvcount > 3   ... View more