Troubleshooting
Problem
Unable to select []Identity Username[] to map Asset information in the DSM Editor.
Cause
Identity Username is a special case. As far as the Log Source Extension is concerned, it is not actually it's own field. Identity Username is derived from the Username value. As long as identity is enabled for a given event mapping and the Username field is populated for that event, the Identity Username should automatically be populated with the Username value.
Resolving The Problem
To resolve the issue, map the event to use Username instead of the Identity Username as shown in the following screen capture.
Where do you find more information?
[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21995505