How do we map same field from CIM Mapping from different model?

[raj_prince]

How do we map same field from CIM Mapping from different model?
-- Example.. from same sourcetype data is coming
field1 -- Map to Inventory model 'dest' field
field2-- Map to Alert model 'dest' field

[woodcock]

You are misunderstanding. Just make sure that whatever is creating dest is promoted to Global level for permissions. Then all Data Model Accelerations will see it regardless of the Data Model.

[gaurav_maniar · Accepted solution]

Hi Raj,

I'm not sure, if I understood your question correctly, you want use different fields from same sourcetype as dest field in CIM and other datamodel.

The easiest way to achieve this defining these fields as eval expression in both datamodel.
Check the attached screenshot.

accept & up-vote the answer if it helped.

[richgalloway]

I argue against modifying data models. Sometimes, it's necessary, but often not. All that is needed here is one or more fieldalias definitions to create the 'dest' field.

Modified data models will override any updates from Splunk so you may miss out on important changes.

[woodcock]

I agree; unless it is a data model that you created, I would avoid changing it unless absolutely necessary. In this case, it is definitely NOT absolutely necessary.

[raj_prince]

Hello Gaurav,

Thank You its working.

[richgalloway]

It's just a field. Once you have the mapping from the source field to 'dest' it will work in all data models.