Knowledge Management

CIM compliance add-on normalizes data to which data model

kannu
Communicator

Hello All ,

Just wanted to know is there any way , in which we can identify that available CIM compliance add on on Splunk base normalizes to which data model of CIM Splunk ,

One way i know is to check tags .conf and eventype.conf , where they mentioned the data model name in form of tag ,

but if tags.conf and  eventype.conf is not there then how to identify which data model is being used in addon .

If anybody has also faced the same issue , like me , or knows how to deal with it , please let me know .

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kannu,

there isn't a pre-defined way to associate an Ad-On to a Data Model.

You should see the tags (defined in tags.conf), and map them to the Data Models Constraints that you can find in the pages of these URL: https://docs.splunk.com/Documentation/CIM/5.3.1/User/Howtousethesereferencetables .

Some Add-Ons could also be associated to more than one Data Model.

Ciao.

Giuseppe

0 Karma

kannu
Communicator

@gcusello  .

 

I am using tags.conf way only , but in few apps its not there , not even eventype.conf , so for those apps its become very difficult .

Few of them are:

proofpoint-decoder-add-on-for-splunk_100
qintel-pmi-add-on-for-splunk_100
technical-add-on-for-honeypy_10

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kannu,

I understand: there aren't eventtypes.conf and tags.conf, (I don't understand how it was declared CIM compliant!).

The only way is consider them as custom and follow the normalization process using the Add-On builder or the SA-CIM Vlaidator.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...