Common information model

[vikassanap2011]

Hi,

I developed splunk app and addon to monitor one infrastructure. While filling out app certification template, I found common information model term. Can anyone tell me what it is? How I should define this with respect to my app?

[mreynov_splunk]

Common Information Model is an abstraction layer between Splunk data sources and Splunk apps (use cases, dashboards, analytics).
In order to satisfy CIM mapping requirement, your data needs to be normalized, ie fields need to be aliased with CIM compliant names and your events need to be tagged to be associated with at least one model on this list: http://docs.splunk.com/Documentation/CIM/latest/User/Overview#What_data_models_are_included

Note: Creating your own data model will not get you CIM compliance.

[alacercogitatus]

The Common Information Model gives a common standard to Splunk data, so that an end-user does not have to know a specific fieldname in custom data. For example, username is mapped to user to be considered CIM compliant.

Read the manual here: http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview. This gives a great insight into this configuration.

[vikassanap2011]

Thanks!
Now, my app is ready.
Do i need to create a data model for it link text.
Actually I am not getting what i need to change or add to satisfy app certification criteria of CIM.