Splunk® Common Information Model Add-on

Common Information Model Add-on Manual

Download manual as PDF

This documentation does not apply to the most recent version of CIM. Click here for the latest version.
Download topic as PDF


How do I find CIM compliant Add-ons?

You can search the Apps site for CIM compliant Add-ons and Apps.

I turned off acceleration in a CIM data model and now my app doesn't work. Why is that?

Certain apps, like the Splunk App for Enterprise Security, may require accelerated data models to work. Use caution when disabling accelerations. Go to Settings > Data models > Manage data models. Click the lightning bolt button next to the data model to turn on acceleration.

I installed an app and some of the CIM data models are now accelerated. Why is that?

Certain apps may require accelerated data models to work and will enable them during setup. If you chose to remove an app that enabled data model acceleration, and now want to disable the acceleration, go to Settings > Data models > Manage data models and click the lightning bolt button. Data model acceleration will be turned off.

Create searches, dashboards, reports
Release Notes

This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.0.0

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters