https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security/m-p/315257#M2877 <P>Hi,</P> <P>I have installed a splunk enterprise trial and also requested Splunk Enterprise Security. I noticed that when I try a simple search "fail* password" in both platform, the fields that available are different. In Splunk Enterprise Security, the fields "dest, src, user" are being shown. I would like to ask is these fields are being known to splunk after installing Splunk Enterprise Security ? <BR /> Thanks all.</P> Fri, 07 Apr 2017 06:15:05 GMT kkkelvinkk 2017-04-07T06:15:05Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security/m-p/315257#M2877 <P>Hi,</P> <P>I have installed a splunk enterprise trial and also requested Splunk Enterprise Security. I noticed that when I try a simple search "fail* password" in both platform, the fields that available are different. In Splunk Enterprise Security, the fields "dest, src, user" are being shown. I would like to ask is these fields are being known to splunk after installing Splunk Enterprise Security ? <BR /> Thanks all.</P> Fri, 07 Apr 2017 06:15:05 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security/m-p/315257#M2877 kkkelvinkk 2017-04-07T06:15:05Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security/m-p/315258#M2878 <P>The Splunk Enterprise Security App installs several security-specific apps and configured inputs. The idea is to make it (Common Information Model) CIM-compliant. The Common Information Model (Splunk_SA_CIM) is one of the apps that is installed. Those fields (dest, src, user) are part of that app. </P> Tue, 29 Sep 2020 13:37:11 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security/m-p/315258#M2878 sfefcu 2020-09-29T13:37:11Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security/m-p/315259#M2879 <P>Thanks. I have installed the CIM, but CIM alone sms did not extract those fields. I also install Splunk Add-on for Unix and Linux and the fields are available now.</P> Fri, 07 Apr 2017 17:45:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security/m-p/315259#M2879 kkkelvinkk 2017-04-07T17:45:55Z