Is there any way to verify whether the app being developed is CIM compliant? I came to know that, if it is CIM compliant, the Splunk ES app should be able to show data indexed by this app. BUT, the ES app is not free to download, nor a trial version is available.
What could be other way to verify compliance?
Use the pivot within each data model. If u can search the events then they are CIM compliant for that data model
If you haven’t seen it yet, you might want to check out the Splunk reference app with associated developer guidance that was built by a Splunk dev team. The current version covers app development topics from getting your data into Splunk Enterprise to building custom reporting through testing and packaging your app. There’s code and tests you can use and the development process is fully documented.
This is an ongoing dev effort by the team so check back often to see what’s been added. Also, feel free to post requests for future improvements and even contribute by reporting bugs or submitting pull requests.
Use the pivot within each data model. If u can search the events then they are CIM compliant for that data model
Oh, that's nice! Thanks!!
Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/UnderstandandusetheCommonInformationMode...
So, you mean to say that, if I get to see my data in those pivots, I could rest assured that it is normalized properly and that it is CIM compliant?