This question is not just asking about how to generally add data to a CIM (http://docs.splunk.com/Documentation/CIM/latest/User/UsetheCIMtonormalizedataatsearchtime)
Many apps come with sourcetypes predefined and ready to go with eventtypes and tags so they work with Common Information Model Data Models immediately (AWS TA for example). I'm not seeing anything like that for access_combined. Am I missing something obvious here? If there exists a definition of the eventtype, tags, field aliases, etc.. then I'd love to use that instead of building it on my own.
Seems very restrictive according to http://docs.splunk.com/Documentation/AddOns/released/ApacheWebServer/Configure. Am I missing something? I also posted here: https://answers.splunk.com/answers/445097/splunk-add-on-for-apache-web-server-too-restrictiv.html
Thanks. I'm also reaching out to the docs team to ask them to reference https://splunkbase.splunk.com/apps/#/page/1/search/CIM-compatible/order/relevance/supported/splunk if not done already. I think it's good to highlight those options.