How do I find CIM compliant Add-ons?
I turned off acceleration in a CIM data model and now my app doesn't work. Why is that?
Certain apps, like the Splunk App for Enterprise Security, may require accelerated data models to work. Use caution when disabling accelerations. Go to Settings > Data models > Manage data models. Click the lightning bolt button next to the data model to turn on acceleration.
I installed an app and some of the CIM data models are now accelerated. Why is that?
Certain apps may require accelerated data models to work and will enable them during setup. If you chose to remove an app that enabled data model acceleration, and now want to disable the acceleration, go to Settings > Data models > Manage data models and click the lightning bolt button. Data model acceleration will be turned off.
Create searches, dashboards, reports
This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.0.0