Splunk Common Information Model 4.3.1: What is the CIM field "cpu_time" supposed to contain?

[kurdbahr]

According to http://docs.splunk.com/Documentation/CIM/4.3.1/User/ApplicationState the field "cpu_time" is of data type "string".
Are there any recommendations regarding the format of this string?

For example tasklist.exe (on Windows) shows the CPU Time as "0:12:34" and ps (on Linux) shows "01:23:45".
This is not a very useful format to do any calculations with.
I could add a calculated numeric field named "cpu_time_seconds" but in a future version of the CIM this field may be defined to mean something completely different.

What are your best practices?
Are there any naming conventions for local CIM extensions?
What are the plans for the future of the CIM?

(And by the way: Does anybody really use the field "cpu_load_mhz" to measure the CPU load per process in Megahertz?)

[lguinn2 · Accepted solution]

I am not the decider of such things, but I believe that you can count on the CIM to be around for a long, long time. I am sure it will continue to evolve and possibly expand, but I expect that changes to existing objects will be infrequent.

The reason that I say this: many of the high-end Splunk apps use the CIM as the basis for integrating diverse data. Splunk Enterprise Security, Splunk IT Service Intelligence and other apps (including some that are not written by Splunk) depend on the CIM. Many additional apps use the CIM as a basis for standardizing names. Consistency across apps makes things easier for users.

And while I don't have time to confirm it, I think that Splunk IT Service Intelligence could make use of "cpu_load_mhz"

Finally, I personally do not know of any naming standards for CIM extensions, but I think you would be wise if you did such a thing.