Splunk Search

CIM compliance process

Darkvader
Explorer

When mapping fields to the CIM in an indexer cluster can I use search time field extractions like IFX, tags and field aliases or is it preferred to make an app with the props and transforms and push those out to my indexers? If so why?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Unless you have a very unusual border case, CIM-mapping is done in search-time, means the fields are calculated/extracted/aliased dynamically during the search, not while indexing. So even if it's done during the search phase executed by the indexers (as per map-reduce algorithm), it's still done according to props/transforms rules pushed to indexers in knowledge bundle from the search tier.

So long story short - you don' t _need_ to configure your indexers in any particular way for CIM compliance.

However, it's often used practice to define everything regarding a specific sourcetype (including both search time and index time settings) in one add-on and distribute this add-on across your environment - both search tier and indexing tier, possibly an intermediate HF tier if you're using one. This way you have a consistent config over all tiers and only the settings relevant at any particular point in time are used by Splunk. So your index-time settings are quietly sitting on search head tier server and are simply not used because they're not needed. And the same goes for search-time settings on indexer tier.

livehybrid
SplunkTrust
SplunkTrust

Hi @Darkvader 

The CIM field extractions should be done on the SearchHeads not your IDX Cluster, but yes it is best practice to setup the relevant conf files (tags/eventtypes/props/transforms etc) in a custom app and deploy this to your SHC.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Darkvader
Explorer

Also could I use the IFX to give me the proper syntax for the field extraction then transfer that regex into an app that is deployed across the SHC or do I need to create the field extraction from scratch myself?

0 Karma

Darkvader
Explorer

Thanks, so what would be the effect if this was done on the UI using the IFX, tags, eventtypes, etc.?

0 Karma

livehybrid
SplunkTrust
SplunkTrust

If you make the changes in the UI of a Seach head then it should work when searching for that data. 

If you make the changes in the UI of an indexer then it wont apply at search time from your SHC.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

gcusello
SplunkTrust
SplunkTrust

Hi @Darkvader ,

usually CIM compliance is used to populate CIM Data Models and this is a Search Time activity executed on the Search Heads.

Ciao.

Giuseppe

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...