Help on basic questions about datamodel

[jip31]

Hello

As far I understand, the Splunk datamodel has two main goals

1)  Data models enable users of Pivot to create compelling reports and dashboards without designing the searches that generate them.  So, the Pivot tool lets to report on a specific data set without the Splunk Search Processing Language 

2) It's possible to refer to the CIM data models to normalize different name of data having the same function

In this case, we need to normalize data by using tags, alias, eventtypes, etc...

• Alerts
• Application State
• Authentication
• Certificates
• Databases
• Data Loss Prevention
• Email
  Interprocess Messaging
• Intrusion Detection
• Inventory
• Java Virtual Machines
• Malware
• Network Resolution (DNS)
• Network Sessions
• Network Traffic
• Performance
• Ticket Management
• Updates
• Vulnerabilities
• Web

Is it correct? Thanks

[richgalloway · Accepted solution]

I agree with #1.

As for #2, I believe it's the other way around.  CIM is what makes datamodels work.  Once the data has been normalized to use CIM field names, the tags and eventtypes used by the DMs become effective.