Splunk Enterprise Security

customizing Datamodels in ES: what will happen in upgrades?

gcusello
Legend

Hi at all,

my customer has the requirement to have the "index" field in each DataModel used in ES.

Obviously, this additional field doesn't modify CIM compliance but it's needed to make an additional filter to data.

But the question is: at the next upgrade of ES, the customization will be maintained or not?

Bye.

Giuseppe

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Customizations to datamodels are stored in $SPLUNK_HOME/etc/apps/Splunk_SA_CIM/local/datamodels.conf.  Any updates to ES or CIM will not affect the custom DM.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Customizations to datamodels are stored in $SPLUNK_HOME/etc/apps/Splunk_SA_CIM/local/datamodels.conf.  Any updates to ES or CIM will not affect the custom DM.

---
If this reply helps you, an upvote would be appreciated.
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>