Post

Splunk: Asset and Identity Framework

Posted Updated
By Steh
1 min read
Splunk: Asset and Identity Framework

Merge for Assets or Identities

If you disable the merge, only the first asset found will be correlated.

1
2

# For example, the asset_lookup_by_str lookup in transforms.conf has max_matches = 1.
# So, the first host it matches in the assets_by_str collection is the only one you'll see in your search results.

Show All Assets

1
2
3
4
5
6

# Option 1
| `datamodel("Identity_Management", "All_Assets")`
| rename All_Assets.* as *

# Option 2
| `assets`

Troubleshooting

1

index=_internal sourcetype="identity_correlation:merge" source=*entity_merge.log*

References

splunk, tools, Information Security
splunk
This post is licensed under CC BY 4.0 by the author.