The Splunk CIM is really a way to overlay a model on top of the raw events. The power of Splunk is that you don't need to fit it into a model when your raw events come in as you can always make changes during design time.
In my experience I tend to leave the raw events as native as possible, so that it has the full richness of the source. Then use knowledge items, such as the CIM to enhance and normalize. The overhead of doing this is negligible. Additionally, if you use the CIM model you can accelerate your data which improves your overall search.
On a side note - I'm looking at doing WebHooks with Mandrill as well. Can you share how you've implemented the hooks?
... View more