Common Information Model and Field Mapping Changes for the Splunk Add-on for JBoss

Version 3.0.0 of the Splunk Add-on for JBoss introduced Common Information Model (CIM) and field mapping changes to its sourcetypes. See the following sections for information on changes to the mapping.

Note: There are no CIM model or Field Mapping changes for jboss:jmx and jboss:gc:log sourcetype.

CIM model and Field Mapping changes for Jboss:server:log

See the following comparison tables for CIM model and field mapping changes for the jboss:server:log sourcetype.

CIM model comparison for versions 2.1.0 and 3.0.0

Sourcetype	message_id	Previous CIM model	New CIM model
jboss:server:log	OPVDX001, WFLYSRV0055, WFLYSRV0056		Alerts

​​Field mapping comparison for versions 2.1.0 and 3.0.0

Source-type	message_id, thread_name	Fields added	Fields removed
jboss:server:log	WFLYSRV0056, WFLYSRV0055, Controller Boot Thread	tag::eventtype, tag

CIM model and Field Mapping changes for Jboss:access:log

See the following comparison tables for CIM model and field mapping changes for the jboss:access:log sourcetype.

CIM model comparison for versions 2.1.0 and 3.0.0

Sourcetype	Previous CIM model	New CIM model
jboss:access:log		Web

​​Field mapping comparison for versions 2.1.0 and 3.0.0

Source-type	Fields added	Fields removed
jboss:access:log	dest, tag, src_ip, dest_port, bytes_out, vendor_product, category, eventtype, http_user_agent_length, bytes, tag::eventtype, src, url_domain, bytes_in, http_referrer_domain, action