Release notes for the Splunk Common Information Model Add-on
Version 4.11.0 of the Splunk Common Information Model Add-on was released on May 14, 2018.
Version 4.11.x of the Splunk Common Information Model Add-on includes the following new features.
- The Common Action Model has been enhanced allow "required" fields to be specified for a given action. See alert_actions.conf.spec for more details.
- The "spent" attribute has been added to Splunk_Audit.View_Activity to represent the amount of time it took in milliseconds to load the view.
|Splunk platform version||Upgrade activity|
|6.6.X or later||If you apply custom tags to data mapped to CIM data models and you use these tags in searches and search filters, add these tags to the whitelists for those models. See Set up the Splunk Common Information Model Add-on for details about the tags whitelist field.|
Version 4.11.x of the Splunk Common Information Model Add-on requires Splunk platform version 6.5.x or later. Some functions on the CIM setup page, such as the accelerate until max time setting, are only available in version 6.6.x and later.
This version of the Splunk Common Information Model Add-on fixes the following issues.
This version of the Splunk Common Information Model Add-on has the following reported known issues.
|Date filed||Issue number||Description|
|2018-12-19||CIM-785||index=_internal was not properly removed from tag=modaction|
|2018-12-05||CIM-784||Common Action Model calculates info_file incorrectly when using per-result alerting|
|2018-05-23||CIM-660||CIM Setup: setting name refinement|
The work around for this would be to set the earliest time and summary data to one of the summary ranges drop down but if the customer wants a customized time then they would only adjust the earliest time and verify that is what is applied to the config.
|2018-03-29||CIM-645||CIM doesn't support multi-value tcp flags in the network traffic data model|
|2014-07-07||CIM-169||Remote search log warning messages from acceleration due to long search strings|
Turn off truncation on indexers in
- As of version 4.11.0, the index definition
cim_summaryhas been removed.
- Several configurations are deprecated and will be removed in a future release.
Third-party software attributions
The Splunk Common Information Model Add-on does not incorporate any third-party software or libraries.
Set up the Splunk Common Information Model Add-on
Support and resource links for the Splunk Common Information Model Add-on
This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.11.0