Generally CIM datamodels do not change very much or very often. New versions might bring additional definitions on which external components (like ES) might rely if they cite particular CIM version as requirement but in general upgrading CIM app should not break existing stuff unless something you're using has just been removed (but it should have been deprecated long time prior to that). But if you look into release notes, it doesn't seem that something like that happened recently. I'd be more worried about CIM mappings which some addons change between versions. That's why you need to read release notes/change lists before upgrading add-ons. Having said that - if you need an official document which you need to use for some formal stuff in your organization, the only way to 100% confirm it would be to raise a support ticket. Whatever we write here is just some random musings by some random people from the Internet. It's not something you should base your business decision on. ... View more

Hi @ParsaIsHash  Just to follow up on this, Ive had confirmation that the page has now been updated to include 9.4.7 confirming compatibility with the following ES versions: 7.3.2, 7.3.3, 7.3.4 8.0.2, 8.0.3, 8.0.40, 8.1.0, 8.1.1, 8.2.0, 8.2.3, 8.3.0 https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/splunk-products-version-compatibility-matrix 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Well, to be quite precise, it's not a raw regex.  The docs say: Match expressions must match the entire name, not just a substring. Match expressions are based on a full implementation of Perl-compatible regular expressions (PCRE) with the translation of "...", "*", and "." Thus, "." matches a period, "*" matches non-directory separators, and "..." matches any number of any characters. So in case of wildcards it can get tricky. I'd try [source::/var/log/apple/...] ... View more