Perform the following prerequisite tasks before starting on these settings:

1. Collect and extract asset and identity data in Splunk Enterprise Security.
2. Format an asset or identity list as a lookup in Splunk Enterprise Security.
3. Configure a new asset or identity list in Splunk Enterprise Security.

Use the global settings to turn off or turn on merge as follows:

1. From the Splunk Enterprise Security menu bar, select Configure, and then All configurations.
2. In the Data section, select Assets and identities.
3. Select the Global settings tab.
4. Scroll to the Activate / Turn on Merge for Assets or Identities panel.
5. Use the toggle to turn on or turn off for Assets or Identities.

ip,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av
192.0.2.2,,host1,,,,,,,,,,,,,,
192.0.2.120,,host1,,,,,,,,,,,,,,
192.0.2.135,,host1,,,,,,,,,,,,,,
192.0.2.242,,host2,,,,,,,,,,,,,,
192.0.2.65,,host2,,,,,,,,,,,,,,

The default is to merge the three rows with nt_host of host1 into one asset, and merge the two rows with host2 into another asset.

If you turn off the merge, then the collection remains the same as the source file, and assets are not merged.

When you do a lookup on an non-merged collection, there is no context for how to resolve the overlapping key field values. For example, the asset_lookup_by_str lookup in transforms.conf has max_matches = 1, so the first host it matches in the assets_by_str collection is the only one you'll see in your search results.