I have a customer that is upgrading Splunk Core from 6.3.3 to 7.1 and Splunk Enterprise Security (ES)/CIM from 4.7.2 to 5.2. They are upgrading apps first and some do not explicitly say CIM compatible with ES 5.2. Could this be an issue or are apps generally CIM backwards compatible? For example, the Cisco Security Suite is compatible with Splunk 7.0 and CIM 4.4. Would this be an issue?