Splunk CIM Add-on 4.2.0: The docs state the Web object should be tagged by "WEB", but why is the Web root constrained with sourcetype=iis* in the data model?

[kundeng]

In the 4.2.0 version of the Common Information Model Add-on Manual, it states clearly the Web object name should be tagged by "web". However, in the actual data model downloaded from splunkbase, the Web root is constrained with sourcetype=iis*. Is this a bug or am I missing something?

[jcoates_splunk]

I think you must be seeing some locally applied constraint -- there's nothing like that out of the box.

[dflodstrom]

Where do you see the constraint 'sourcetype=iis*'.

I am using the latest version of CIM and my top level constraint is 'tag=web'.

[kundeng]

That is strange. I have the latest version which is Version 4.2.0.