All Apps and Add-ons

Splunk Common Information Model 4.3.1: What is the CIM field "cpu_time" supposed to contain?

kurdbahr
Path Finder

According to http://docs.splunk.com/Documentation/CIM/4.3.1/User/ApplicationState the field "cpu_time" is of data type "string".
Are there any recommendations regarding the format of this string?

For example tasklist.exe (on Windows) shows the CPU Time as "0:12:34" and ps (on Linux) shows "01:23:45".
This is not a very useful format to do any calculations with.
I could add a calculated numeric field named "cpu_time_seconds" but in a future version of the CIM this field may be defined to mean something completely different.

What are your best practices?
Are there any naming conventions for local CIM extensions?
What are the plans for the future of the CIM?

(And by the way: Does anybody really use the field "cpu_load_mhz" to measure the CPU load per process in Megahertz?)

0 Karma
1 Solution

lguinn2
Legend

I am not the decider of such things, but I believe that you can count on the CIM to be around for a long, long time. I am sure it will continue to evolve and possibly expand, but I expect that changes to existing objects will be infrequent.

The reason that I say this: many of the high-end Splunk apps use the CIM as the basis for integrating diverse data. Splunk Enterprise Security, Splunk IT Service Intelligence and other apps (including some that are not written by Splunk) depend on the CIM. Many additional apps use the CIM as a basis for standardizing names. Consistency across apps makes things easier for users.

And while I don't have time to confirm it, I think that Splunk IT Service Intelligence could make use of "cpu_load_mhz"

Finally, I personally do not know of any naming standards for CIM extensions, but I think you would be wise if you did such a thing.

View solution in original post

0 Karma

lguinn2
Legend

I am not the decider of such things, but I believe that you can count on the CIM to be around for a long, long time. I am sure it will continue to evolve and possibly expand, but I expect that changes to existing objects will be infrequent.

The reason that I say this: many of the high-end Splunk apps use the CIM as the basis for integrating diverse data. Splunk Enterprise Security, Splunk IT Service Intelligence and other apps (including some that are not written by Splunk) depend on the CIM. Many additional apps use the CIM as a basis for standardizing names. Consistency across apps makes things easier for users.

And while I don't have time to confirm it, I think that Splunk IT Service Intelligence could make use of "cpu_load_mhz"

Finally, I personally do not know of any naming standards for CIM extensions, but I think you would be wise if you did such a thing.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...