Splunk Enterprise Security

How to avoid mixng values of assets by 'entitymerge' command in ES

evelenke
Contributor

Hi Splunkers ,

any advice how to avoid mixng values in assets by entitymerge command?
I have 5 fileds marked as Multivalue (category, ip, mac) and sometimes it cause trouble like multiple assets mapped to all existing categories or multiple IP addresses, and thus incorrect notable events.
Do I understand correctly that I should mark fields as Multivalue if there might be several valuse (like 2 mac addresses for computer or several categories (router|network) ?
SE V7.3.3, Enterprise Security Version 6.0.1 Build 2

lkutch_splunk
Splunk Employee
Splunk Employee

If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset or identity, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead. 


Upcoming versions have some features that might address your issue.

You can disable the merge:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Globalsettings#Enable_merge_for_assets_or_ident...

You can put the duplicates in different entity zones:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Globalsettings#Enable_entity_zones_for_Assets_o...

You can change the key to a different field for the merge:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

Take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Manageassetsandidentititiesuponupgrade 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...