I haven't been able to find an answer to this in the documentation. Can you add data models to the Splunk Common Information Model (CIM) app? Or do you always have to use one of the default data models?
You are allowed to create your own data models if you want. Its good to stick with the CIM models where possible because there are many searches that already use them.
View solution in original post