Why is my eventtype not recognized by the Splunk Common Information Model Add-on?

[prabhasgupte]

I have some event, with report and vulnerability tags. I have also set global permissions to this event, so that other apps could see it.
However, when I use Splunk CIM add-on, it does not recognize it. It neither shows the eventtype, nor the tags. It says "Eventtype 'my-event' does not exist or is disabled". Whereas, the event does exist and is enabled.

If I use default search 'Search and Reporting' app, I can see the proper eventtype and tags.

What is missing or going wrong?

[jcoates_splunk]

does this help? http://blogs.splunk.com/2015/05/01/relating-add-ons-to-cim/ -- I'd expect the "Data Model Tag Population By Add-on" report to list your add-on next to vulnerability?

[koshyk]

hope you are aware of "DataModels" within CIM? You need to baseline your data to a relevant DataModel and tag correctly and have relevant fields.
http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview

[prabhasgupte]

Yes, I do have my data fields mapped to those of "Vulnerabilities" data model. (mapped through field aliases and lookup tables.) But still I face this problem. What could be the reason?

[koshyk]

in that case please paste few rows of sample key-value pairs..

<your Search> | table * | fields - _raw