Splunk Enterprise

How to configure CIM datamodel index whitelisting through configuration file(s)?

fatsug
Contributor

Hello Community

I've been looking at the installation process of Splunk CIM and got stuck on a step.

After installation there seems to be a need to whitelist indexes for datamodels (or vice versa). I realize this can be done pretty easily through the GUI though normally the configuration is handled centrally.

Having come up empty looking through the content of the app/package, is it possible to specify index whitelists for particular datamodels in any conf file that I may have missed?

Best regards

Labels (1)
0 Karma
1 Solution

smurf
Communicator

Hi,

index whitelists are defined in macros for each data mode. Look at the macros that are in the CIM app.

smurf

View solution in original post

smurf
Communicator

Hi,

index whitelists are defined in macros for each data mode. Look at the macros that are in the CIM app.

smurf

fatsug
Contributor

Thank you very much @smurf. I was planning to start editing the GUI and tracking filechanges to pinpoint the right one though this does look like the right spot for whitelisting:

[cim_Endpoint_indexes]
definition = ()

While technically a second question (sorry) do you know the format for definition? Is it just CSV

[cim_Endpoint_indexes]
definition = (index1, index2)
0 Karma

smurf
Communicator

No probs.

Definition of a macro is the search itself. So it could look something like this:

[cim_Endpoint_indexes]
definition = (index=index1 OR index=index2)

You can find more details in the macros.conf spec macros.conf - Splunk Documentation

 

smurf

fatsug
Contributor

Fantastic!

I managed to find some defined macros and figured as much. Though no I know for sure and can push new config

Have a really nice weeked and best refards

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...