Does the Common Information Model Add-on do anything out of the box?

[hopnscotch]

From everything I've read it looks like you just use the definitions in the model for fields and tags to alias or tag you events yourself. What does the add-on do?

[aelliott]

Simply provides a standard method of parsing, categorizing, and normalizing data.

http://docs.splunk.com/Documentation/CIM/latest/User/Overview

The add-on is meant as an add-on, not an app. It is not meant to have a UI.
It's pretty powerful to display all your data into common formats. You can then create dashboards with those standard fields without having to re-invent the wheel every time.

There are several "CIM" compliant addons within the splunk apps and addons that some have already formatted popular logs into this format for you:
http://apps.splunk.com/apps/#/search/CIM%20compliant
http://apps.splunk.com/apps/#/search/Common%20Information%20Model
http://apps.splunk.com/apps/#/search/CIMifies

[aelliott]

Correct.
The CIM provides normalization for many types of events and provides the data models for the Common Information Models.
In addition you can find other ones in the splunk apps.
Other than those resources, you have to create your own.

[hopnscotch]

I know there are other vendor specific add-ons that actually do the aliasing/normalization. From the answer above it looks like this add-on provides data models.

So any normalization actually needs to be done manually using the fields/tags from the model documentation (other than any vendor specific add-ons you can find).

Do I have that correct?

[hazekamp]

To build on aelliott's comments above, while this is not an app with a UI, we ship with approx 15 datamodels out of the box that can be used with the search app's Pivot interface. These can also be accelerated to provide a high performance column store that can be queried with "| tstats".