topic Re: How do we map same field from CIM Mapping from different model? in Reporting

How do we map same field from CIM Mapping from different model?

raj_prince — Mon, 08 Jun 2020 23:27:22 GMT

How do we map same field from CIM Mapping from different model?
-- Example.. from same sourcetype data is coming
field1 -- Map to Inventory model 'dest' field
field2-- Map to Alert model 'dest' field

Re: How do we map same field from CIM Mapping from different model?

richgalloway — Fri, 06 Mar 2020 13:50:37 GMT

It's just a field. Once you have the mapping from the source field to 'dest' it will work in all data models.

Re: How do we map same field from CIM Mapping from different model?

gaurav_maniar — Fri, 06 Mar 2020 14:02:20 GMT

Hi Raj,

I'm not sure, if I understood your question correctly, you want use different fields from same sourcetype as dest field in CIM and other datamodel.

The easiest way to achieve this defining these fields as eval expression in both datamodel.
Check the attached screenshot.

accept & up-vote the answer if it helped.

Re: How do we map same field from CIM Mapping from different model?

richgalloway — Fri, 06 Mar 2020 14:38:36 GMT

I argue against modifying data models. Sometimes, it's necessary, but often not. All that is needed here is one or more fieldalias definitions to create the 'dest' field.

Modified data models will override any updates from Splunk so you may miss out on important changes.

Re: How do we map same field from CIM Mapping from different model?

woodcock — Fri, 06 Mar 2020 19:26:11 GMT

You are misunderstanding. Just make sure that whatever is creating dest is promoted to Global level for permissions. Then all Data Model Accelerations will see it regardless of the Data Model.

Re: How do we map same field from CIM Mapping from different model?

raj_prince — Mon, 09 Mar 2020 09:16:39 GMT

Hello Gaurav,

Thank You its working.

Re: How do we map same field from CIM Mapping from different model?

woodcock — Mon, 09 Mar 2020 11:12:52 GMT

I agree; unless it is a data model that you created, I would avoid changing it unless absolutely necessary. In this case, it is definitely NOT absolutely necessary.