Install the Splunk Common Information Model Add-on

Install the Common Information Model Add-on to your search heads only. Installing this add-on to indexers results in redundant data model acceleration overhead if acceleration is enabled.

Note: If you are using Splunk Cloud, file a support ticket to have the Common Information Model installed to your Splunk Cloud search heads.

1. Download from Splunkbase.
2. From the Splunk Web interface on your search head, click on Apps > Manage Apps to open the Apps Management page.
3. Click Install app from file button, locate the downloaded file, and click Upload. If you are upgrading to a newer version of the add-on, be sure to check the Upgrade option to overwrite your existing version.
4. Verify that the add-on is installed. It should be listed in the list of apps installed within the Apps Management page and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_SA_CIM.
5. Review the indexes.conf and either adjust the summary index creation settings to match your preferences or simply remove this index definition. For more information on configuring indexes.conf, see "Create and edit indexes" and "Configure index size with volumes" in the Managing Indexers and Clusters of Indexers manual, part of the Splunk Enterprise documentation.

Once the Common Information Model add-on is installed, there is no further configuration you need to do, unless you want to accelerate any of the data models.

Note: The data models included in the CIM add-on are configured with data model acceleration turned off. See "Enable data model acceleration" in the Splunk Enterprise documentation for more details.