All Apps and Add-ons

Why is my eventtype not recognized by the Splunk Common Information Model Add-on?

prabhasgupte
Communicator

I have some event, with report and vulnerability tags. I have also set global permissions to this event, so that other apps could see it.
However, when I use Splunk CIM add-on, it does not recognize it. It neither shows the eventtype, nor the tags. It says "Eventtype 'my-event' does not exist or is disabled". Whereas, the event does exist and is enabled.

If I use default search 'Search and Reporting' app, I can see the proper eventtype and tags.

What is missing or going wrong?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

does this help? http://blogs.splunk.com/2015/05/01/relating-add-ons-to-cim/ -- I'd expect the "Data Model Tag Population By Add-on" report to list your add-on next to vulnerability?

0 Karma

koshyk
Super Champion

hope you are aware of "DataModels" within CIM? You need to baseline your data to a relevant DataModel and tag correctly and have relevant fields.
http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview

0 Karma

prabhasgupte
Communicator

Yes, I do have my data fields mapped to those of "Vulnerabilities" data model. (mapped through field aliases and lookup tables.) But still I face this problem. What could be the reason?

0 Karma

koshyk
Super Champion

in that case please paste few rows of sample key-value pairs..

<your Search> | table * | fields - _raw
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...