A civic workstation's DHCP hostname does not match its DNS name, and Asset and Identity never attaches owner or priority to the notable. Which keys does A&I use to join events to assets?
Select an answer to reveal the explanation.
Short Explanation
A&I matches on the nametags assets actually wear: IP, Windows hostname, DNS, MAC, and identity fields for people. If DHCP named the laptop one thing and DNS another, the join misses. Internal Splunk ids and DLP policy names are not those keys.
Full Explanation
Asset and Identity matching joins events to asset records using keys such as ip, nt_host, dns, and mac, and joins users on identity fields. A civic gap like DHCP hostname versus DNS name is a common miss that leaves owner and priority unattached. Internal index metadata, notable comments, and DLP policy names are not A&I match keys. Know the join keys so hostname mismatches can be fixed in the lookups.