https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497364#M8658 <P>Try it. It should work, except I believe you'll need to define the entire data model in your custom JSON file since I doubt Splunk will merge them. Be sure to name your app so it comes before Splunk_SA_CIM. Also, be aware that your changes will trump any future updates to that DM by the CIM app.</P> Wed, 30 Sep 2020 05:25:06 GMT richgalloway 2020-09-30T05:25:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497363#M8657 <P>Hello,</P> <P>I have a question about modification of data model in CIM:</P> <P>I would like to add one child dataset to DM "Change". Can I do it by separate application?</P> <P>What I mean exactly: If I create a modified Change.json file with a new dataset, place it to separate app (eg. <CODE>my_change_dm</CODE>) and place this app to <CODE>$splunk_home/etc/apps directory</CODE> - will my modified JSON file merge with Change.json in <CODE>Splunk_SA_CIM</CODE> app?<BR />Or is there another way to modify DM in CIM without modifying it directly in the <CODE>Splunk_SA_CIM</CODE> app?</P> <P>I know that I can modify DM directly in <CODE>Splunk_SA_CIM</CODE>, but for some reason I need to make some research. <BR />Thank you very much for any info.</P> <P>Regards,<BR />Lukas Mecir</P> Sun, 07 Jun 2020 16:10:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497363#M8657 lukasmecir 2020-06-07T16:10:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497364#M8658 <P>Try it. It should work, except I believe you'll need to define the entire data model in your custom JSON file since I doubt Splunk will merge them. Be sure to name your app so it comes before Splunk_SA_CIM. Also, be aware that your changes will trump any future updates to that DM by the CIM app.</P> Wed, 30 Sep 2020 05:25:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497364#M8658 richgalloway 2020-09-30T05:25:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497365#M8659 <P>You don't need your own app, but definitely do not edit the existing datamodel. Just clone it and call it something like <CODE>Change_Clone</CODE> and then do whatever you would like. Keep them totally separate and only use the clone.</P> Thu, 14 May 2020 19:56:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497365#M8659 woodcock 2020-05-14T19:56:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497366#M8660 <P>Thank you for your answer. I tried and you are right - entire DM must be defined in custom app and Splunk do not merge content of JSON files.</P> Fri, 15 May 2020 07:16:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497366#M8660 lukasmecir 2020-05-15T07:16:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497367#M8661 <P>Hi Gregg, thank you for your answer. Just for clarification - the cloned data model "Change_Clone" will not be used by out-of-the-box reports and dashboards etc. in Splunk ES, because they are not aware of it (they are aware of out-of-the-box DM "Change" only), am I right? This is not problem for me now, I just would like clarify this.</P> Fri, 15 May 2020 07:20:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497367#M8661 lukasmecir 2020-05-15T07:20:36Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497368#M8662 <P>And another question - when you say "do not edit the existing datamodel", what do you exactly mean? Do you mean that I should not change Change.json file in Splunk_SA_CIM/default dir, or I should not change it at all (even if I change it by putting modified Change.json to Splunk_SA_CIM/local dir)?</P> Wed, 30 Sep 2020 05:25:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497368#M8662 lukasmecir 2020-09-30T05:25:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497369#M8663 <P>Yes, you are correct but the majority of use-cases in Splunk require adjusting and tuning to work right for each client so you are most-likely going to modify just about everything that you use in ES anyway so changing from one datamodel to another is not a big deal.</P> Sat, 16 May 2020 00:21:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497369#M8663 woodcock 2020-05-16T00:21:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497370#M8664 <P>Correct. Do not change the JSON files. Changing datamodels.conf is fine.</P> Sat, 16 May 2020 00:22:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-modify-data-model-in-CIM-without-doing-so-directly-in-CIM/m-p/497370#M8664 woodcock 2020-05-16T00:22:08Z