All Apps and Add-ons

Does the Common Information Model Add-on do anything out of the box?

hopnscotch
Path Finder

From everything I've read it looks like you just use the definitions in the model for fields and tags to alias or tag you events yourself. What does the add-on do?

0 Karma

aelliott
Motivator

Simply provides a standard method of parsing, categorizing, and normalizing data.

http://docs.splunk.com/Documentation/CIM/latest/User/Overview

The add-on is meant as an add-on, not an app. It is not meant to have a UI.
It's pretty powerful to display all your data into common formats. You can then create dashboards with those standard fields without having to re-invent the wheel every time.

There are several "CIM" compliant addons within the splunk apps and addons that some have already formatted popular logs into this format for you:
http://apps.splunk.com/apps/#/search/CIM%20compliant
http://apps.splunk.com/apps/#/search/Common%20Information%20Model
http://apps.splunk.com/apps/#/search/CIMifies

aelliott
Motivator

Correct.
The CIM provides normalization for many types of events and provides the data models for the Common Information Models.
In addition you can find other ones in the splunk apps.
Other than those resources, you have to create your own.

0 Karma

hopnscotch
Path Finder

I know there are other vendor specific add-ons that actually do the aliasing/normalization. From the answer above it looks like this add-on provides data models.

So any normalization actually needs to be done manually using the fields/tags from the model documentation (other than any vendor specific add-ons you can find).

Do I have that correct?

0 Karma

hazekamp
Builder

To build on aelliott's comments above, while this is not an app with a UI, we ship with approx 15 datamodels out of the box that can be used with the search app's Pivot interface. These can also be accelerated to provide a high performance column store that can be queried with "| tstats".

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!