Splunk® Add-on Builder

Splunk Add-on Builder User Guide

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of AddonBuilder. Click here for the latest version.
Acrobat logo Download topic as PDF

Map to CIM

In the Map to CIM section, map the fields from your data to the fields in one of the predefined common information models (CIM) to normalize data at search time.

Note  The Splunk Common Information Model add-on is required to use this feature.

Add an event type

Before you can map fields, you need to create an event type to generate events from which to extract fields.

For each sourcetype for which you want to map fields, add an event type:

  1. On the Step 5: Map to CIM page, click Add Event Type.
  2. Enter a name for the event type, and select a sourcetype from which to generate events.
  3. In the search bar, enter a search to select events:
    • Enter "*" to select all events for the sourcetype.
    • Apply additional search criteria as needed.
  4. Click Save.

AddonBuilder 5MaptoCIMEventType v2.png

The Add-on Builder returns to the Step 5: Map to CIM page, and you can now map events from this event type to the CIM.

Map events to the CIM

Map events from an event type to the CIM:

  1. Select an event type. Fields from this event type appear in the list of event fields.
  2. Select an event field.
  3. Select a CIM from the list of pre-defined CIM data models.
  4. Select a CIM field that you want to map to the event field.
  5. Optionally, click Eval to apply an eval statement to the mapping. Enter the eval string and click Submit.
  6. Click Map. The CIM mapping appears in the list.

AddonBuilder 5MaptoCIM2 v2.png

Repeat this procedure for all of the fields you want to map.

Click Next to save your changes and proceed to the next section.

Learn more

For more information, see the following Splunk Enterprise documentation:

Last modified on 29 June, 2016
Extract Fields

This documentation applies to the following versions of Splunk® Add-on Builder: 1.1.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters