Splunk® Common Information Model Add-on

Common Information Model Add-on Manual

Download manual as PDF

This documentation does not apply to the most recent version of CIM. Click here for the latest version.
Download topic as PDF

Install the Splunk Common Information Model Add-on

Install the Common Information Model Add-on to your search heads only. Installing this add-on to indexers results in redundant data model acceleration overhead if acceleration is enabled.

Note: If you are using Splunk Cloud, file a support ticket to have the Common Information Model installed to your Splunk Cloud search heads.

  1. Download from Splunkbase.
  2. From the Splunk Web interface on your search head, click on Apps > Manage Apps to open the Apps Management page.
  3. Click Install app from file button, locate the downloaded file, and click Upload. If you are upgrading to a newer version of the add-on, be sure to check the Upgrade option to overwrite your existing version.
  4. Verify that the add-on is installed. It should be listed in the list of apps installed within the Apps Management page and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_SA_CIM.
  5. Review the indexes.conf and either adjust the summary index creation settings to match your preferences or simply remove this index definition. For more information on configuring indexes.conf, see "Create and edit indexes" and "Configure index size with volumes" in the Managing Indexers and Clusters of Indexers manual, part of the Splunk Enterprise documentation.

Once the Common Information Model add-on is installed, there is no further configuration you need to do, unless you want to accelerate any of the data models.

Note: The data models included in the CIM add-on are configured with data model acceleration turned off. See "Enable data model acceleration" in the Splunk Enterprise documentation for more details.

Overview of the Splunk Common Information Model
Release notes for the Splunk Common Information Model Add-on

This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.1.0, 4.1.1, 4.2.0

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters