A civic workstation's DHCP hostname does not match its DNS name, and Asset and Identity never attaches owner or priority to the notable. Which keys does A&I use to join events to assets?
Select an answer to reveal the explanation.
Short Explanation
A&I matches on the nametags assets actually wear: IP, Windows hostname, DNS, MAC, and identity fields for people. If DHCP named the laptop one thing and DNS another, the join misses. Internal Splunk ids and DLP policy names are not those keys.
Full Explanation
Asset and Identity joins events to assets using asset keys such as ip, nt_host, dns, and mac, plus identity fields for users. When a civic workstation's DHCP hostname does not match its DNS name and owner or priority never attach, the join keys are mismatched or incomplete—Asset and Identity cannot enrich what it cannot key consistently across DHCP and DNS. Internal Splunk metadata fields, notable comment text, and mail DLP policy names are not asset join keys for municipal enrichment workflows.
Using only the Splunk internal _cd and _indextime fields fails—these identify events inside Splunk, not assets on the network. Using only the notable's comment text fails because free text is not a deterministic join key for ownership or priority. Using only the mail-gateway DLP policy name fails by tying workstation enrichment to an unrelated mail control label.
Exam caveat: memorize Asset and Identity asset keys—ip, nt_host, dns, and mac—and identity fields; distractors offer Splunk internal fields or ticket text.
Operational check: align DHCP hostname, DNS name, and MAC in the asset lookup for the workstation, verify events populate matching fields from technical add-ons, and retest notable enrichment for owner and priority after the next correlation fire.