All Apps and Add-ons

Addon Builder CIM mapping

New Member

Hi @all,

While mapping an eventtype to CIM, i get an error icon and I am not able to choose Email.
How can I fix that error, is there any log?

alt text

Best Regards,

0 Karma


Were you able to find a solution to this?

In my case, this always happens when accelerating datamodels. Disabled acceleration and removing the copy of your datamodel json under local in the splunk cim app folder fixes it.

0 Karma

Splunk Employee
Splunk Employee

Seems like you installed Splunk_SA_CIM but customized some models by yourself. AoB needs some attributes to load data models in UI but any customizations will remove these attributes. Please refer the following doc to validate your data model JSON files manually.

0 Karma


All the logs generated by add-on builder is available at /opt/splunk/var/log/splunk folder.


You can search using index=_internal sourcetype="splunk:tabuilder:log"

have you checked the Splunk_SA_CIM is at a version compatible with the version of your add-on builder?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...