customizing Datamodels in ES: what will happen in upgrades?

[gcusello]

Hi at all,

my customer has the requirement to have the "index" field in each DataModel used in ES.

Obviously, this additional field doesn't modify CIM compliance but it's needed to make an additional filter to data.

But the question is: at the next upgrade of ES, the customization will be maintained or not?

Bye.

Giuseppe

[richgalloway · Accepted solution]

Customizations to datamodels are stored in $SPLUNK_HOME/etc/apps/Splunk_SA_CIM/local/datamodels.conf.  Any updates to ES or CIM will not affect the custom DM.