Pre-defined Data Models

rmck2012 — Wed, 08 Jan 2014 22:52:20 GMT

Does anybody know if there are pre-defined or common data models that are documented somewhere that could be used as a guide to assist with building data models for those of us who are less familiar with that process?

For example, I would think there are numerous common data sources where a basic guide could be created to walk users who are new to Splunk 6 through the process of building a usable data model.

These common data sources could include things such as:

Cisco ASA logs
Microsoft domain controller security event logs
Web filter logs, such as from a Cisco Ironport or Barracuda web filter
Network infrastructure devices, such as Cisco switch and router logs

These are just a few, but it could be useful as a starting point to get users familiar with the process of creating and using data models in Splunk 6.

Thank you,

Rick

Re: Pre-defined Data Models

araitz — Thu, 09 Jan 2014 00:59:47 GMT

Check out the Splunk Common Information Model app here:

http://apps.splunk.com/app/1621/

See the documentation here:

http://docs.splunk.com/Documentation/CIM/latest/User/RelationshipofCIMappstodata

Let us know what other data sources you would like to see data models for.

topic Pre-defined Data Models in Knowledge Management

Pre-defined Data Models

Re: Pre-defined Data Models