Splunk Enterprise Security

How to add new field to existing CIM data model?

vpsmax1
Loves-to-Learn

Hello.

Using the eval function, trying to add a new field to the Change data model.  When I try to add the new field (ie. time_millis=_time), no results come back from my tstats query.  When I perform the same tstats query using SPL, I am able to get proper values (ie. timestamp with milliseconds).  Does anyone have suggestions on how to add new fields to an existing CIM data model?  Thanks in advance for any advice.

Regards,
Max

 

 

Labels (1)
0 Karma

starcher
Influencer

It is usually a bad idea to aadd anything to one of the stock CIM DataModels. The reason is unlike normal Splunk configurations dadtamodels are stored as JSON files and do NOT benefit of the default/local merging.

So if you edit a DM you now have a full static copy in the local folder that overrides the one in default. So if the stock ones get updated you never see it. You are then in the business of hand adding every little change.

We usually recommend since you have to have a copy anyway make an actual different named copy. So you can not tamper with the stock ones and use your custom one as desired.

0 Karma

vpsmax1
Loves-to-Learn

Thanks for your feedback.  I will look at making a copy and using a custom DM.  As for the purpose of adding the fields, can you suggest ways to ...

- Resolve timestamp issues (ie. _time not returning seconds/milliseconds)
- Return _raw as a field (to obtain extra fields/data beyond what the CIM data model offers)

 

0 Karma

lblystone
Splunk Employee
Splunk Employee

There are numerous posts on converting timestamps to milliseconds, and formating the _time field (may involve changes to the sourcetype) so the actual syntax/solution will be based on your data set. Here is a good example of converting to milleseconds https://community.splunk.com/t5/Splunk-Search/TimeFormat-conversion-to-millisecond/m-p/212326

If you are looking to search on the _raw field,  adding that to a data model is not advisable. One of its purposes of a data model is to reduce and consolidate the number of fields and size of events to a summary version so adding that field would directly contradict that purpose. I would recommend just using that field for your search or adding additional field extractions to the data and then adding the new fields to the custom DM. 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...