Addon parsed field does not go in proper Data Model

[SIEMStudent]

Hi Splunkers,

for our environments, I needed a custom parser for some waf logs, so I created an addon to provide this.
The addon has been created on a local Splunk istance on my Desktop; once completed and tested, it has been loaded on our Splunk Cloud istance, where it has Global permissions.

The point is the following: the addon, once installed on cloud, correctly parse the logs and perform field extraction as desidered, coerently with results got on local istance; also, the events are correctly tagged with "attack" and "ids" as desired, due we want to see those events on Data Model Intrusion Detection.
Unfortunately, when I try to perform a search with Intrusion Detection DM, the events are not present; a simple search like

|tstats summariesonly=true fillnull_value="N/D" count from datamodel=Intrusion_Detection by sourcetype

does not show me, in output, the sourcetype created during addon creation.

I followed the usual way I use to create addon Data Model matching, which is:

1. create a eventtype in eventtypes.conf with syntax:

[<eventtype name>]
search = <sourcetype> <parameters list>

2. use the above eventtype in tags.conf for tagging, with syntax

[eventtype=<eventtype name>]
attack=enabled
ids=enabled

If permissions are ok, what could be the root cause?

[PickleRick]

Eventtype is one thing but it's common with data models (especially the CIM ones) to restrict events to specific indexes. Do the events you'd like to see in the datamodel go into the right index? (in case of CIM's Intrusion Detection datamodel the indexes are defined in `cim_Intrusion_Detection_indexes` macro)

[SIEMStudent]

Hi Rick,

thanks for your suggestion; I suppose you are right, because the incriminated logs are in a index which is not included in the ones belonging to suggested macro.
I will work on this.