topic Re: Common information model in Reporting

Common information model

vikassanap2011 — Mon, 17 Aug 2015 12:31:19 GMT

Hi,

I developed splunk app and addon to monitor one infrastructure. While filling out app certification template, I found common information model term. Can anyone tell me what it is? How I should define this with respect to my app?

Re: Common information model

alacercogitatus — Mon, 17 Aug 2015 13:02:50 GMT

The Common Information Model gives a common standard to Splunk data, so that an end-user does not have to know a specific fieldname in custom data. For example, username is mapped to user to be considered CIM compliant.

Read the manual here: http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview. This gives a great insight into this configuration.

Re: Common information model

vikassanap2011 — Mon, 17 Aug 2015 14:36:12 GMT

Thanks!
Now, my app is ready.
Do i need to create a data model for it link text.
Actually I am not getting what i need to change or add to satisfy app certification criteria of CIM.

Re: Common information model

mreynov_splunk — Mon, 17 Aug 2015 18:02:03 GMT

Common Information Model is an abstraction layer between Splunk data sources and Splunk apps (use cases, dashboards, analytics).
In order to satisfy CIM mapping requirement, your data needs to be normalized, ie fields need to be aliased with CIM compliant names and your events need to be tagged to be associated with at least one model on this list: http://docs.splunk.com/Documentation/CIM/latest/User/Overview#What_data_models_are_included

Note: Creating your own data model will not get you CIM compliance.