Splunk Dev

Splunk CIM data models acceleration issue

eduardKiyko
Explorer

Hi all!
I am developing Splunk app right now and I observe some really weird stuff related to data models. Ive cloned Network_Resolution data model and I have 2 fully the same data models, but there is one issue: manually cloned data model easy accelerates and Splunks CIM data model doesn`t. The only difference - these data models belongs to different apps.
Maybe anyone have faced with similar issue before? If yes, how did you fix this?alt text

Tags (1)
0 Karma

skalliger
Motivator

I'm not sure about that, but this might be conflicting because you probably are trying to build the same index-based accelerations multiple times. There is no need to do so.

Why do you want to clone the exact data model? Simply share it.

Skalli

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...