All Apps and Add-ons

Why is my eventtype not recognized by the Splunk Common Information Model Add-on?

prabhasgupte
Communicator

I have some event, with report and vulnerability tags. I have also set global permissions to this event, so that other apps could see it.
However, when I use Splunk CIM add-on, it does not recognize it. It neither shows the eventtype, nor the tags. It says "Eventtype 'my-event' does not exist or is disabled". Whereas, the event does exist and is enabled.

If I use default search 'Search and Reporting' app, I can see the proper eventtype and tags.

What is missing or going wrong?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

does this help? http://blogs.splunk.com/2015/05/01/relating-add-ons-to-cim/ -- I'd expect the "Data Model Tag Population By Add-on" report to list your add-on next to vulnerability?

0 Karma

koshyk
Super Champion

hope you are aware of "DataModels" within CIM? You need to baseline your data to a relevant DataModel and tag correctly and have relevant fields.
http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview

0 Karma

prabhasgupte
Communicator

Yes, I do have my data fields mapped to those of "Vulnerabilities" data model. (mapped through field aliases and lookup tables.) But still I face this problem. What could be the reason?

0 Karma

koshyk
Super Champion

in that case please paste few rows of sample key-value pairs..

<your Search> | table * | fields - _raw
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...