topic cim vladiator % DM coverage in Other Usage

cim vladiator % DM coverage

dm2 — Tue, 06 Feb 2024 09:21:34 GMT

Hi,

I installed SA_CIM_Vladiator and when running % checks to see DM coverage I do see gaps between extracted fields or fields that are found on specific indexes and the app does not return them in the results

Re: cim vladiator % DM coverage

gcusello — Tue, 06 Feb 2024 09:40:37 GMT

Hi @dm2,

are these fields shared at app or Global level?

they must be at Global level to be viewed in this ad in the other apps.

Ciao.

Giuseppe

Re: cim vladiator % DM coverage

dm2 — Tue, 06 Feb 2024 09:43:12 GMT

yes, if I run a search index=imperva I do see all the fields

Re: cim vladiator % DM coverage

gcusello — Tue, 06 Feb 2024 11:12:36 GMT

Hi @dm2,

if you run this search in the SA-CIM_vladiator app, do you see fields?

if not (as I understood) you have to share them at Global level.

The app leval shared fields are visible only inside the app where they are created.

Ciao.

Giuseppe

Re: cim vladiator % DM coverage

splunkreal — Fri, 30 Jan 2026 13:55:41 GMT

Hi @gcusello same issue here but we can't share all fields globally just for cim vladiator, is there any solution?

Thanks!

Re: cim vladiator % DM coverage

PickleRick — Fri, 30 Jan 2026 16:10:01 GMT

Remember that not all of events from a particular index must match your datamodel.

A datamodel definition specifies constraints which events must meet in order to be a part of the root dataset. In case of CIM datamodels this is based on tags. In case of Intrusion Detection datamodel you need two tags for your event - ids and attack. So if you want to check the coverage for the raw data, you need to search for those two tags.

index=whatever_index_you're_using tag=ids tag=attack