Test the asset and identity merge process in Splunk Enterprise Security

You can test the asset and identity merge process if you want to confirm that the data produced by the merge process is expected and accurate. Run the saved searches that perform the merge process without outputting the data to the merged lookups to determine what the merge will do with your data without actually performing the merge. These steps are not required, but can be performed to validate the merge works as expected.

Test the merge process without performing a merge and outputting the data to a lookup.

1. From the Splunk ES menu bar, select Configure > Content Management.
2. Locate the first of the three primary saved searches Identity - Asset CIDR Matches - Lookup Gen.
3. Click the search name to open it.
4. Copy the search from the Search field.
5. Open the Search page.
6. Paste the search and remove the `output_*` macro. For example, change | `asset_sources` | `make_assets_cidr` | `output_assets("SA-IdentityManagement", "assets_by_cidr.csv")` to | `asset_sources` | `make_assets_cidr`.
7. Run the search.
8. Repeat steps 2-7 for the other two searches, Identity - Asset String Matches - Lookup Gen and Identity - Identity Matches - Lookup Gen.