Hello
As far I understand, the Splunk datamodel has two main goals
1) Data models enable users of Pivot to create compelling reports and dashboards without designing the searches that generate them. So, the Pivot tool lets to report on a specific data set without the Splunk Search Processing Language
2) It's possible to refer to the CIM data models to normalize different name of data having the same function
In this case, we need to normalize data by using tags, alias, eventtypes, etc...
- Alerts
- Application State
- Authentication
- Certificates
- Databases
- Data Loss Prevention
- Email
Interprocess Messaging - Intrusion Detection
- Inventory
- Java Virtual Machines
- Malware
- Network Resolution (DNS)
- Network Sessions
- Network Traffic
- Performance
- Ticket Management
- Updates
- Vulnerabilities
- Web
Is it correct? Thanks
