The Splunk Common Information Model (CIM) Add-On is often referred to as an application because it provides functionality beyond that of a typical add-on. While the CIM Add-On does function as an add-on in that it extends the capabilities of Splunk, it also provides pre-built dashboards, reports, and field extractions that are typically associated with applications. The CIM Add-On is specifically designed to help users implement the CIM, which is a standard data model that enables users to normalize their data and correlate events across different data sources. As such, the CIM Add-On provides a set of pre-configured field extractions and tags that map to the CIM, making it easier for users to normalize their data. In addition, the CIM Add-On also includes pre-built dashboards and reports that provide insights into security, network, and other operational data, which are features typically associated with applications. Overall, while the CIM Add-On is technically an add-on, it is often referred to as an application because it provides a more comprehensive set of features and functionality than a typical add-on. Understanding this distinction may be important for testing purposes, particularly if you need to understand how the CIM Add-On interacts with other add-ons or applications in your Splunk environment. ... View more

One way to do this is by using Splunk's rex command, which allows you to extract fields using regular expressions. Here's an example search query that extracts the x and y values for start.point and end.point and calculates the distance your_search_here | rex field=start.point "\[(?<x1>\d+\.\d+),(?<y1>\d+\.\d+)\]" | rex field=end.point "\[(?<x2>\d+\.\d+),(?<y2>\d+\.\d+)\]" | eval distance = sqrt(pow((x2 - x1), 2) + pow((y2 - y1), 2)) ... View more