Splunk Enterprise Security

Can you help with an Issue merging identities from two lookup tables in Enterprise Security?

ehowardl3
Path Finder

I have identity information I am pulling from two different sources in two different lookup tables. One lookup table has most of the identity columns populated, except for the "nick" column. The other lookup table has only the "email" and "nick" columns populated.

My expectation was that when the identity merge happens, I would only have one identity per email, and that identity would have all of the identity columns populated, including the "nick" field.

What actually happens is I get two separate identities per email address, with each identity only containing the information from its respective lookup table.

Is this expected behavior?

Thanks,
Eric

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

That is expected. Unfortunately... ES does not expect you to have duplicate identities in multiple tables. It doesn't "merge" identities well. It really merges sources. It expects you to have a row per identity. You should use your second lookup to fixup the first before feeding the combined result to ES.

The identity and asset system in ES is in need of updating to handle things like you describe gracefully. So for now it is better you do the touch up before feeding it to ES.

View solution in original post

starcher
SplunkTrust
SplunkTrust

That is expected. Unfortunately... ES does not expect you to have duplicate identities in multiple tables. It doesn't "merge" identities well. It really merges sources. It expects you to have a row per identity. You should use your second lookup to fixup the first before feeding the combined result to ES.

The identity and asset system in ES is in need of updating to handle things like you describe gracefully. So for now it is better you do the touch up before feeding it to ES.

ehowardl3
Path Finder

Thanks, for the response, that's what I was afraid of...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...