Knowledge Manager Manual

 


Understand and use the Common Information Model Add-on

Understand and use the Common Information Model Add-on

The Common Information Model Add-on is based on the idea that you can break down most log files into two components:

  • fields
  • event category tags

With these two components a knowledge manager can set up their log files in a way that makes them easily processable by Splunk and which normalizes noncompliant log files and forces them to follow a similar schema. The Common Information Model details the standard fields and event category tags that Splunk uses when it processes most IT data.

In the past, the Common Information Model was represented here as a set of tables that one could use to normalize their data by ensuring that they were using the same field names and event tags for equivalent events from different sources or vendors.

We've since updated the Common Information Model. It's now set up as an Add-on that implements the CIM tables as data models. You can use these data models in two ways:

  • Initially, you can use them to test whether your fields and tags have been normalized correctly.
  • After you've verified that your data is normalized you can use the models to generate reports and dashboard panels via Pivot.

You can download the Common Information Model Add-on from Splunk Apps here. For a more in-depth overview of the CIM Add-on, see the Common Information Model Add-on product documentation.

This documentation applies to the following versions of Splunk: 6.0 , 6.0.1 , 6.0.2 , 6.0.3 , 6.0.4 , 6.0.5 , 6.0.6 , 6.0.7 , 6.1 , 6.1.1 , 6.1.2 , 6.1.3 , 6.1.4 , 6.1.5 , 6.2.0 , 6.2.1 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!