All Apps and Add-ons

Why is my eventtype not recognized by the Splunk Common Information Model Add-on?

prabhasgupte
Communicator

I have some event, with report and vulnerability tags. I have also set global permissions to this event, so that other apps could see it.
However, when I use Splunk CIM add-on, it does not recognize it. It neither shows the eventtype, nor the tags. It says "Eventtype 'my-event' does not exist or is disabled". Whereas, the event does exist and is enabled.

If I use default search 'Search and Reporting' app, I can see the proper eventtype and tags.

What is missing or going wrong?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

does this help? http://blogs.splunk.com/2015/05/01/relating-add-ons-to-cim/ -- I'd expect the "Data Model Tag Population By Add-on" report to list your add-on next to vulnerability?

0 Karma

koshyk
Super Champion

hope you are aware of "DataModels" within CIM? You need to baseline your data to a relevant DataModel and tag correctly and have relevant fields.
http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview

0 Karma

prabhasgupte
Communicator

Yes, I do have my data fields mapped to those of "Vulnerabilities" data model. (mapped through field aliases and lookup tables.) But still I face this problem. What could be the reason?

0 Karma

koshyk
Super Champion

in that case please paste few rows of sample key-value pairs..

<your Search> | table * | fields - _raw
0 Karma
Get Updates on the Splunk Community!

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...