Getting Data In

Getting new index data into data model

ygoltsev
Engager

Hi - I am trying to configure the authentication data model to include additional source data indexes.

We want to include Duo logs in our dashboard in Splunk ES, but am unsure how to get the data model to recognize the new data.  The logs also appear to be in a different format, but I notice there's a method to "eval" the fields in the data model.  Can you please advise best practice for this? 

Thanks.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to make sure the Duo logs are CIM-compliant.  Check the manual at https://docs.splunk.com/Documentation/CIM/4.20.0/User/Authentication to see what fields the DM expects.  Add FIELDALIAS and other settings to props.conf to create those fields.  It's not necessary to have all of them, but you'll want to have the fields your ES use cases need.

Once that's done, go to ES's Settings menu and select "CIM Setup".  Add the Duo index to the list of indexes used by the Authentication datamodel and click Save.  Wait for the DM to rebuild and check the results.

---
If this reply helps you, Karma would be appreciated.

ygoltsev
Engager

This is helpful thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...