cim vladiator % DM coverage

[dm2]

Hi, 

I installed SA_CIM_Vladiator and when running % checks to see DM coverage I do see gaps between extracted fields or fields that are found on specific indexes and the app does not return them in the results

 

[PickleRick]

Remember that not all of events from a particular index must match your datamodel.

A datamodel definition specifies constraints which events must meet in order to be a part of the root dataset. In case of CIM datamodels this is based on tags. In case of Intrusion Detection datamodel you need two tags for your event - ids and attack. So if you want to check the coverage for the raw data, you need to search for those two tags.

index=whatever_index_you're_using tag=ids tag=attack

[dm2]

yes, if I run a search index=imperva I do see all the fields

[gcusello]

Hi @dm2,

if you run this search in the SA-CIM_vladiator app, do you see fields?

if not (as I understood) you have to share them at Global level.

The app leval shared fields are visible only inside the app where they are created.

Ciao.

Giuseppe

[gcusello]

Hi @dm2,

are these fields shared at app or Global level?

they must be at Global level to be viewed in this ad in the other apps.

Ciao.

Giuseppe

[splunkreal]

Hi @gcusello  same issue here but we can't share all fields globally just for cim vladiator, is there any solution? 

Thanks!