Splunk® Common Information Model Add-on

Common Information Model Add-on Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of CIM. Click here for the latest version.
Acrobat logo Download topic as PDF

Install the Splunk Common Information Model Add-on

Install the Common Information Model Add-on to your search heads only. Installing this add-on to indexers results in redundant data model acceleration overhead if acceleration is enabled.

Note: If you are using Splunk Cloud, file a support ticket to have the Common Information Model installed to your Splunk Cloud search heads.

  1. Download from Splunkbase.
  2. From the Splunk Web interface on your search head, click on Apps > Manage Apps to open the Apps Management page.
  3. Click Install app from file button, locate the downloaded file, and click Upload. If you are upgrading to a newer version of the add-on, be sure to check the Upgrade option to overwrite your existing version.
  4. Verify that the add-on is installed. It should be listed in the list of apps installed within the Apps Management page and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_SA_CIM.
  5. Review the indexes.conf and either adjust the summary index creation settings to match your preferences or simply remove this index definition. For more information on configuring indexes.conf, see "Create and edit indexes" and "Configure index size with volumes" in the Managing Indexers and Clusters of Indexers manual, part of the Splunk Enterprise documentation.

Once the Common Information Model add-on is installed, there is no further configuration you need to do, unless you want to accelerate any of the data models.

Note: The data models included in the CIM add-on are configured with data model acceleration turned off. See "Enable data model acceleration" in the Splunk Enterprise documentation for more details.

Last modified on 05 October, 2015
Overview of the Splunk Common Information Model
Release notes for the Splunk Common Information Model Add-on

This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.1.0, 4.1.1, 4.2.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters