- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Developing a CIM compliant add-on, is it mandatory to map ALL my data fields to those of the data model's?

prabhasgupte
Communicator
06-03-2015
07:51 PM
When developing CIM compliant add-on, is it mandatory to map ALL of my data fields to the data model's fields?
Does that affect/keep my data from appearing in ES?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MichaelPriest
Communicator
06-04-2015
02:22 AM
No you don't have to map all of your fields when creating the data model. You may have 50 data fields but only want 25 in your data model, you set this when creating it, you specify the fields to include. Have a look at the Knowledge Manager Manual located here for more detail:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/WhatisSplunkknowledge
