Splunk® Enterprise Security

Administer Splunk Enterprise Security

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Test the asset and identity merge process in Splunk Enterprise Security

You can test the asset and identity merge process if you want to confirm that the data produced by the merge process is expected and accurate. Run the saved searches that perform the merge process without outputting the data to the merged lookups to determine what the merge will do with your data without actually performing the merge. These steps are not required, but can be performed to validate the merge works as expected.

Test the merge process without performing a merge and outputting the data to a lookup.

  1. From the Splunk ES menu bar, select Configure > Content > Content Management.
  2. Locate the first of the three primary saved searches Identity - Asset CIDR Matches - Lookup Gen.
  3. Click the search name to open it.
  4. Copy the search from the Search field.
  5. Open the Search page.
  6. Paste the search and remove the `output_*` macro. For example, change | `asset_sources` | `make_assets_cidr` | `output_assets("SA-IdentityManagement", "assets_by_cidr.csv")` to | `asset_sources` | `make_assets_cidr`.
  7. Run the search.
  8. Repeat steps 2-7 for the other two searches, Identity - Asset String Matches - Lookup Gen and Identity - Identity Matches - Lookup Gen.
Last modified on 01 July, 2022
PREVIOUS
Asset and identity fields after processing in Splunk Enterprise Security
  NEXT
Customize the asset and identity merge process in Splunk Enterprise Security

This documentation applies to the following versions of Splunk® Enterprise Security: 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 6.0.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters