SSE v3.1.2 CIM compliance check returns only 2 compliant fields

[Suirand1]

I am very new to Splunk. Using Universal forwarder I send windows application, security, system, sysmon logs to SSE app. I followed SSE provided all data onboarding guides for indexes , sources, sourcetypes configuration. I successfully run automated introspection in data inventory dashboard. However when i run CIM Compliance Check I get only 2 compliant fields for Microsoft products. SPL searches also fail since I am missing some fieldnames which are provided in Security content. I have TA-windows and TA-sysmon installed in UF and Searched. Logs gets parsed as XML data by these TA

If I understand correctly I am missing some CIM datamodel. Could you explain where to find and how to apply the right CIM data model for this app.

[richgalloway]

If you have a separate indexer, be sure to install TAs there as well as on the search head and forwarder.
Have you installed the Common Information Model app?

[Suirand1]

Indexer and search head is the same VM.  Common Information Model app along with SA-cim_vladiator are installed. 

Do not know how to debug. Is there any additional configuration needed for my setup and SSE app?

P.S. I have noticed in DATA Inventory dashboard that my products "Status" do not get "Completed".  It allways stays in "Analyzing CIM and Event Size" status.

[marcovigilante]

Hi,
did you find any fix about this issue? I've managed to edit the "complete" and "all-done" status within the kvstore, but this can't be the only fix to do.

[richgalloway]

I'm not sure what else you should do.