- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
As far I understand, the Splunk datamodel has two main goals
1) Data models enable users of Pivot to create compelling reports and dashboards without designing the searches that generate them. So, the Pivot tool lets to report on a specific data set without the Splunk Search Processing Language
2) It's possible to refer to the CIM data models to normalize different name of data having the same function
In this case, we need to normalize data by using tags, alias, eventtypes, etc...
- Alerts
- Application State
- Authentication
- Certificates
- Databases
- Data Loss Prevention
- Email
Interprocess Messaging - Intrusion Detection
- Inventory
- Java Virtual Machines
- Malware
- Network Resolution (DNS)
- Network Sessions
- Network Traffic
- Performance
- Ticket Management
- Updates
- Vulnerabilities
- Web
Is it correct? Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I agree with #1.
As for #2, I believe it's the other way around. CIM is what makes datamodels work. Once the data has been normalized to use CIM field names, the tags and eventtypes used by the DMs become effective.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I agree with #1.
As for #2, I believe it's the other way around. CIM is what makes datamodels work. Once the data has been normalized to use CIM field names, the tags and eventtypes used by the DMs become effective.
If this reply helps you, Karma would be appreciated.
