Splunk® Common Information Model Add-on

Common Information Model Add-on Manual

Download manual as PDF

Download topic as PDF


The fields in the Web data model describe web server and/or proxy server data in a security or operational context.

Note: A dataset is a component of a data model. In versions of the Splunk platform prior to version 6.5.0, these were referred to as data model objects.

Tags used with the Web event datasets

The following tags act as constraints to identify your events as being relevant to this data model. For more information, see How to use these reference tables.

Dataset name Tag name
Web web
|____ Proxy

Fields for Web event datasets

The following table lists the extracted and calculated fields for the event datasets in the model. Note that it does not include any inherited fields. For more information, see How to use these reference tables.

Dataset name Field name Data type Description Abbreviated list of example values
Web action string The action taken by the server or proxy.
Web app string The application detected or hosted by the server/site such as WordPress, Splunk, or Facebook.
Web bytes number The total number of bytes transferred (bytes_in + bytes_out).
Web bytes_in number The number of inbound bytes transferred.
Web bytes_out number The number of outbound bytes transferred.
Web cached boolean Indicates whether the event data is cached or not. true, false, 1, 0
Web category string The category of traffic, such as may be provided by a proxy server.
Web cookie string The cookie file recorded in the event.
Web dest string The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.
Web dest_bunit string These fields are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for these fields when writing add-ons.
Web dest_category string
Web dest_priority string
Web duration number The time taken by the proxy event, in milliseconds.
Web http_content_type string The content-type of the requested HTTP resource.
Web http_method string The HTTP method used in the request. ES expects:


Web http_referrer string The HTTP referrer used in the request. The W3C specification and many implementations misspell this as http_referer. Use a FIELDALIAS to handle both key names.
Web http_user_agent string The user agent used in the request.
Web http_user_agent_length number The length of the user agent used in the request.
Web response_time number The amount of time it took to receive a response, if applicable, in milliseconds.
Web site string The virtual site which services the request, if applicable.
Web src string The source of the network traffic (the client requesting the connection).
Web src_bunit string These fields are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for these fields when writing add-ons.
Web src_category string
Web src_priority string
Web status string The HTTP response code indicating the status of the proxy request. 100, 101, 102, 200, 201, 202, 203, 204, 205, 206, 207, 208, 226, 300, 301, 302, 303, 304, 305, 306, 307, 308, 400, 401, 402, 403, 404, 405, 406, 407, 408, 409, 410, 411, 412, 413, 414, 415, 416, 417, 422, 423, 424, 426, 428, 429, 431, 500, 501, 502, 503, 504, 505, 506, 507, 508, 510, 511
Web tag string This automatically generated field is used to access tags from within datamodels. Do not define extractions for this field when writing add-ons.
Web uri_path string The path of the resource served by the webserver or proxy, such as /CertEnroll/Blue%20Coat%20Systems

4cYqBI6c08kr4S302gIKUCIZdgAAAAAnQA%3D%3D /bag /en-US/account/login /en-US/account/login /en-US/app/simple_xml_examples/custom_viz_
forcedirected /en-US/config /en-US/splunkd/__raw/services/apps/local/simple
_xml_examples /en-US/splunkd/__raw/services/configs/conf-web/settings /en-US/splunkd/__raw/services/data/user-prefs/general /en-US/splunkd/__raw/services/messages /en-US/splunkd/__raw/services/messages /en-US/splunkd/__raw/services/messages /en-US/splunkd/__raw/services/messages /en-US/splunkd/__raw/services/saved/searches/_new /en-US/splunkd/__raw/services/server/info/server-info /en-US/splunkd/__raw/servicesNS/-/-/search/jobs

Web uri_query string The path of the resource requested by the client, such as ?return_to=%2Fen-US%2Fapp%2Fsimple_xml_examples%2Fcustom_viz_

?earliest=0&latest= ?autoload=1 ?output_mode=json&_=1424960631223 ?output_mode=json&_=1424960631232 ?output_mode=json&_=1424960631225 ?output_mode=json&sort_key=timeCreated_
epochSecs&sort_dir=desc&_=1424960631236 ?output_mode=json&sort_key=timeCreated_
1000&_=1424933765618 ?output_mode=json&sort_key=timeCreated_
1000&_=1424933765619 ?output_mode=json&sort_key=timeCreated_
1000&_=1424960631233 ?output_mode=json&_=1424960631228 ?output_mode=json&_=1424960631224 ?id=admin__admin_c2ltcGxlX3htbF9leGFtcGxlcw__

Web url string The URL of the requested HTTP resource, such as http://0.channel36.facebook.com/x/1746719903/ false/p_1243021868=11 http://0.channel36.facebook.com/x/3833188787/ false/p_1243021868=11 http://0.channel37.facebook.com/x/3598566724/ false/p_576766886=1 http://01275269302.channel11.facebook.com/x/ 832619022/false/p_792194432=2 http://03978257738.channel38.facebook.com/x/ 3905575759/false/p_1576492095=0 http://1.gravatar.com/avatar/72f230f80 db7d667952d596cafbaf928?s=16&d=identicon&r=PG EC64FCE11F15337B7BE75CF1EF7443FFA8 E58454580830E8D41D695469C01E8D128BF891F4D 0438A70BE3E0A0D7BABD610DE3A588DF1804F823 CD509F0A2177AD97F7B9F3D09BEDA005C241B873 349D525C0264A9F1655FD408F70DD465574D5E8E BE0DC29030A6365C1F025CB2954E2C38E0404CE4 D24970B2613EB394E2611FD7EC8EB2AD84318421CD 40DF01E6DF002AFF775653030012EF432D59072C0 5F1A939A6C1467CC3A129801587BE559CB16653513 3EAA6C78D3C4BDEC6D795C2934A176DACBB3839 8ED490322037DDB59101EE725138FF8534D89657F4 43F084ACE66DF159581AEF495F317536C34477D005 49B514A81CC689BFB7ACA7C10399C2C7BD76319876 C9890FB4172BBC7CBDF50F7CE0B164BE7F8D8228E9 555E39EE9D0F50B6CE3F610533544A959087F03FCD 16D8FDF0F9C5EB692E3C7EE61B75272961CC29A05D 5F3A1629BBF7C70044BBC65D30812B8EB3E0C7510C DA0F636808B32925481602F702714C60ADC7040F58 CACA4BDD61D776C796D5344495B93AC08F16FC851E 3FB157CEBB563CC1 xml_examples/components/forcedirected/ forcedirected.js?_=1424960631242
Web url_length number The length of the URL.
Web user string The user that requested the HTTP resource.
Web user_bunit string These fields are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for these fields when writing add-ons.
Web user_category string
Web user_priority string
Web vendor_product string The vendor and product of the proxy server, such as Squid Proxy Server. This field can be automatically populated by vendor and product fields in your data.
Approaches to using the CIM

This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.8.0, 4.9.0, 4.9.1, 4.10.0, 4.11.0, 4.12.0, 4.13.0, 4.14.0


Thanks for asking about this @Kellewic. If you can let me know more details about the use-case for port as a separate field, I can open a ticket to investigate.

Lkutch splunk, Splunker
January 15, 2019

Why is there no dest_port for Web data model?

January 12, 2019

Hi! Thanks for the documentation feedback. Since uri_path, uri_query, and url are strings, they could be almost anything. However, some quick examples could be like the following:
uri_path = /cart.do
uri_query = action=purchase&itemId=EST-14&JSESSIONID=SD7SL9FF2ADFF4961
url = http://www.example.com/cart.do?action=addtocart&itemId=EST-14&categoryId=STRATEGY&productId=DC-SG-G02
I'll update the doc with more specific/common examples.

Lkutch splunk, Splunker
October 12, 2018

Examples for uri_path, uri_query and url are missing.

October 8, 2018

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters