All Apps and Add-ons

Why does every search in the RWI - Executive Dashboard app reference data models?

Path Finder

The Splunkbase page for the RWI app states: "There are no major considerations for installing Remote Work Insights - simply follow your usual Splunk App Deployment procedure."

I find this to be very misleading because if you do not have fully populated data models this app will do literally nothing, even if you point the macros to the correct indexes.

Please be transparent if you want people to install & use your app. Advice is welcomed, perhaps I'm missing a relevant workaround.


I guess it requires no major consideration so long as you are running the common information model add-on which creates the data models.

There may be more pieces to the puzzle but the network_sessions and authentication data model are both created from within the CIM add-on (link below). I believe this is a heavy hitter so if your Splunk instance is already hitting performance limits during peak usage you may wish to have a conversation before loading this add-on.

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...