When mapping fields to the CIM in an indexer cluster can I use search time field extractions like IFX, tags and field aliases or is it preferred to make an app with the props and transforms and push those out to my indexers? If so why?
Unless you have a very unusual border case, CIM-mapping is done in search-time, means the fields are calculated/extracted/aliased dynamically during the search, not while indexing. So even if it's done during the search phase executed by the indexers (as per map-reduce algorithm), it's still done according to props/transforms rules pushed to indexers in knowledge bundle from the search tier.
So long story short - you don' t _need_ to configure your indexers in any particular way for CIM compliance.
However, it's often used practice to define everything regarding a specific sourcetype (including both search time and index time settings) in one add-on and distribute this add-on across your environment - both search tier and indexing tier, possibly an intermediate HF tier if you're using one. This way you have a consistent config over all tiers and only the settings relevant at any particular point in time are used by Splunk. So your index-time settings are quietly sitting on search head tier server and are simply not used because they're not needed. And the same goes for search-time settings on indexer tier.
Hi @Darkvader
The CIM field extractions should be done on the SearchHeads not your IDX Cluster, but yes it is best practice to setup the relevant conf files (tags/eventtypes/props/transforms etc) in a custom app and deploy this to your SHC.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing
Also could I use the IFX to give me the proper syntax for the field extraction then transfer that regex into an app that is deployed across the SHC or do I need to create the field extraction from scratch myself?
Thanks, so what would be the effect if this was done on the UI using the IFX, tags, eventtypes, etc.?
If you make the changes in the UI of a Seach head then it should work when searching for that data.
If you make the changes in the UI of an indexer then it wont apply at search time from your SHC.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing
Hi @Darkvader ,
usually CIM compliance is used to populate CIM Data Models and this is a Search Time activity executed on the Search Heads.
Ciao.
Giuseppe