Splunk Common Information Model

Version: 8.5.0

CIM is organized around data models. Each data model contains datasets, historically called data model objects. Datasets inherit fields and constraints from parent datasets. Event datasets ultimately inherit from BaseEvent; search datasets inherit from BaseSearch. All Splunk data model datasets can use the base fields _time, host, source, and sourcetype.

• Tags and constraints decide which events belong in a dataset.
• Fields describe the effective normalized shape that searches, dashboards, pivots, and downstream apps expect. Each field entry states whether it is base, declared, calculated, or inherited.
• Calculated field entries include a calculation block because they create or normalize fields at search time.
• Lookup files document expected values, translations, and enrichments, such as actions, protocols, HTTP statuses, DNS reply codes, endpoint statuses, and severities.