Reporting

Common information model

New Member

Hi,

I developed splunk app and addon to monitor one infrastructure. While filling out app certification template, I found common information model term. Can anyone tell me what it is? How I should define this with respect to my app?

0 Karma

Splunk Employee
Splunk Employee

Common Information Model is an abstraction layer between Splunk data sources and Splunk apps (use cases, dashboards, analytics).
In order to satisfy CIM mapping requirement, your data needs to be normalized, ie fields need to be aliased with CIM compliant names and your events need to be tagged to be associated with at least one model on this list: http://docs.splunk.com/Documentation/CIM/latest/User/Overview#What_data_models_are_included

Note: Creating your own data model will not get you CIM compliance.

SplunkTrust
SplunkTrust

The Common Information Model gives a common standard to Splunk data, so that an end-user does not have to know a specific fieldname in custom data. For example, username is mapped to user to be considered CIM compliant.

Read the manual here: http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview. This gives a great insight into this configuration.

New Member

Thanks!
Now, my app is ready.
Do i need to create a data model for it link text.
Actually I am not getting what i need to change or add to satisfy app certification criteria of CIM.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!