Splunk Search

Developing a CIM compliant add-on, is it mandatory to map ALL my data fields to those of the data model's?

prabhasgupte
Communicator

When developing CIM compliant add-on, is it mandatory to map ALL of my data fields to the data model's fields?

Does that affect/keep my data from appearing in ES?

0 Karma

MichaelPriest
Communicator

No you don't have to map all of your fields when creating the data model. You may have 50 data fields but only want 25 in your data model, you set this when creating it, you specify the fields to include. Have a look at the Knowledge Manager Manual located here for more detail:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/WhatisSplunkknowledge

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...