https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-CORE-Search-function-Like-ES/m-p/386538#M4067 <P>CIM is its own app and can be installed and used anywhere you want to. <A href="https://splunkbase.splunk.com/app/1621/">https://splunkbase.splunk.com/app/1621/</A></P> Wed, 09 May 2018 16:35:39 GMT smoir_splunk 2018-05-09T16:35:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-CORE-Search-function-Like-ES/m-p/386537#M4066 <P>In our DEV space we are running a single search head with ES installed. We have built identity lookups from our HR data and AD. As we migrate to production we will have 3 node SH cluster and a ES Search head building our lookups. We will use CIM for normalization. If I want to move those lookups to our 3 Node SH cluster I know I can move the .CSV files, but is the normalization available on a NON ES Search Head?</P> <P>Thanks!</P> Wed, 09 May 2018 14:47:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-CORE-Search-function-Like-ES/m-p/386537#M4066 pfabrizi 2018-05-09T14:47:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-CORE-Search-function-Like-ES/m-p/386538#M4067 <P>CIM is its own app and can be installed and used anywhere you want to. <A href="https://splunkbase.splunk.com/app/1621/">https://splunkbase.splunk.com/app/1621/</A></P> Wed, 09 May 2018 16:35:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-CORE-Search-function-Like-ES/m-p/386538#M4067 smoir_splunk 2018-05-09T16:35:39Z