Splunk® Common Information Model Add-on

Common Information Model Add-on Manual

Download manual as PDF

This documentation does not apply to the most recent version of CIM. Click here for the latest version.
Download topic as PDF

Verify your data

The Common Information Model describes what needs to be normalized in specific event data, and the data models implement that description. Data models help to enforce the CIM. If your data is not properly mapped with tags and fields, the data will not show up in reports or dashboards that you created using data models and pivot. In this way, data models can be used to verify that your data complies with the Common Information Model.

Install the Splunk_SA_CIM and create a new pivot from a data model that uses the new data type. If there is no data present in the pivot created from that data model, something is broken.

For example, select one of the Missing Extractions objects in the Compute Inventory data model and click Pivot to create a new pivot, searching for these missing extractions. If any extractions are found, it indicates that there is data that is not correctly mapped. If the pivot search returns zero, then there are no missing extractions and your data is mapped correctly for this object.

Extract fields and assign tags
Support and resource links

This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.0.0

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters