All Apps and Add-ons

Splunk Common Information Model 4.3.1: What is the CIM field "cpu_time" supposed to contain?

kurdbahr
Path Finder

According to http://docs.splunk.com/Documentation/CIM/4.3.1/User/ApplicationState the field "cpu_time" is of data type "string".
Are there any recommendations regarding the format of this string?

For example tasklist.exe (on Windows) shows the CPU Time as "0:12:34" and ps (on Linux) shows "01:23:45".
This is not a very useful format to do any calculations with.
I could add a calculated numeric field named "cpu_time_seconds" but in a future version of the CIM this field may be defined to mean something completely different.

What are your best practices?
Are there any naming conventions for local CIM extensions?
What are the plans for the future of the CIM?

(And by the way: Does anybody really use the field "cpu_load_mhz" to measure the CPU load per process in Megahertz?)

0 Karma
1 Solution

lguinn2
Legend

I am not the decider of such things, but I believe that you can count on the CIM to be around for a long, long time. I am sure it will continue to evolve and possibly expand, but I expect that changes to existing objects will be infrequent.

The reason that I say this: many of the high-end Splunk apps use the CIM as the basis for integrating diverse data. Splunk Enterprise Security, Splunk IT Service Intelligence and other apps (including some that are not written by Splunk) depend on the CIM. Many additional apps use the CIM as a basis for standardizing names. Consistency across apps makes things easier for users.

And while I don't have time to confirm it, I think that Splunk IT Service Intelligence could make use of "cpu_load_mhz"

Finally, I personally do not know of any naming standards for CIM extensions, but I think you would be wise if you did such a thing.

View solution in original post

0 Karma

lguinn2
Legend

I am not the decider of such things, but I believe that you can count on the CIM to be around for a long, long time. I am sure it will continue to evolve and possibly expand, but I expect that changes to existing objects will be infrequent.

The reason that I say this: many of the high-end Splunk apps use the CIM as the basis for integrating diverse data. Splunk Enterprise Security, Splunk IT Service Intelligence and other apps (including some that are not written by Splunk) depend on the CIM. Many additional apps use the CIM as a basis for standardizing names. Consistency across apps makes things easier for users.

And while I don't have time to confirm it, I think that Splunk IT Service Intelligence could make use of "cpu_load_mhz"

Finally, I personally do not know of any naming standards for CIM extensions, but I think you would be wise if you did such a thing.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...