topic Re: How to validate data which is uploaded to Splunk is as per CIM model in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232987#M99028 <P>Yes, I went through CIM Validation datamodel but I am not able to make much out of it.<BR /> Could you please try to explain with example?</P> Wed, 25 May 2016 08:55:10 GMT rupeshhiremath 2016-05-25T08:55:10Z How to validate data which is uploaded to Splunk is as per CIM model https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232983#M99024 <P>Hi,</P> <P>In our application we have data in a specific format. We are converting this data to CIM model (say IntrusionDetection, Malware etc) and then uploading to Splunk.<BR /> Now once its get uploaded I want to verify from Splunk side whether that data is as per specific CIM model or not. <BR /> How to go ahead with this?</P> Fri, 06 May 2016 07:38:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232983#M99024 rupeshhiremath 2016-05-06T07:38:20Z Re: How to validate data which is uploaded to Splunk is as per CIM model https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232984#M99025 <P>One useful thing is the <A href="http://docs.splunk.com/Documentation/CIM/4.4.0/User/UsetheCIMtovalidateyourdata#Use_the_CIM_Validation_.28S.o.S..29_datamodel">CIM Validation datamodel</A>. This can help to find what extractions are still missing or which are misnamed. You can install the CIM on a new test Splunk instance and feed a bit of the data to it and test, or if you are already pumping that data into your regular Splunk install, well, that's OK too. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I've also found usefulness from just cracking open the appropriate datamodel and doing some pivots. A lot can be determined if you have a reasonably well known set of data and run some confirming pivots on that data. </P> Sun, 08 May 2016 02:00:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232984#M99025 Richfez 2016-05-08T02:00:06Z Re: How to validate data which is uploaded to Splunk is as per CIM model https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232985#M99026 <P>Hi rich7177,</P> <P>Could you please elaborate more on this as I am new to Splunk. And more importantly I wanted to this with automation.</P> <P>Thanks</P> Mon, 09 May 2016 11:45:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232985#M99026 rupeshhiremath 2016-05-09T11:45:24Z Re: How to validate data which is uploaded to Splunk is as per CIM model https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232986#M99027 <P>Rupeshshiremath, did you try reviewing the link to the CIM Validation datamodel that Rich posted? </P> Mon, 09 May 2016 14:21:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232986#M99027 piebob 2016-05-09T14:21:21Z Re: How to validate data which is uploaded to Splunk is as per CIM model https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232987#M99028 <P>Yes, I went through CIM Validation datamodel but I am not able to make much out of it.<BR /> Could you please try to explain with example?</P> Wed, 25 May 2016 08:55:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232987#M99028 rupeshhiremath 2016-05-25T08:55:10Z Re: How to validate data which is uploaded to Splunk is as per CIM model https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232988#M99029 <P>And more importantly there is no directory called $SPLUNK_HOME/etc/apps/Splunk_SA_CIM/default</P> Tue, 29 Sep 2020 09:47:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232988#M99029 rupeshhiremath 2020-09-29T09:47:12Z Re: How to validate data which is uploaded to Splunk is as per CIM model https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232989#M99030 <P>My bad..I was looking at different Splunk instance <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span><BR /> I am able to see missing extractions using CIM Validation datamodel..thank you.</P> <P>Now trying how can I use CIM Validation datamodel with python.</P> Sun, 29 May 2016 13:07:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-validate-data-which-is-uploaded-to-Splunk-is-as-per-CIM/m-p/232989#M99030 rupeshhiremath 2016-05-29T13:07:23Z