If a username does not match the ‘identity’ column in the identities list, which column...

 If a username does not match the ‘identity’ column in the identities list, Splunk Enterprise Security checks the ‘email’ column next. The ‘email’ column contains the email address associated with the identity. If the email address matches the username, Splunk Enterprise Security assigns the identity to the user. If the email address does not match, Splunk Enterprise Security checks the ‘nickname’ column next, followed by the ‘ip’ column, and finally the ‘last_name’ and ‘first_name’ columns. The order of the columns is determined by the identity_match setting in the identity_manager.conf file. References =

Identity correlation

identity_manager.conf