Splunk add-on for CIM mapping of VMware NSX syslog fields and tagging for data models, including IDS. Note that the event types and some of the fields may need to be adjusted based on how your NSX tags the syslog messages. The add-on need to be installed on the search heads for parsing. This add-on was inspired by the 'VMware NSX-T Splunk App' (https://splunkbase.splunk.com/app/4241).