Splunk search for Fields in CIM Datamodel
Copy
| rest splunk_server=local /servicesNS/-/Splunk_SA_CIM/data/models | fields title eai:data | spath input=eai:data path=objects{}.fields{} output=fields | mvexpand fields | spath input=fields | fields - eai:data fields
This search will list out the fields that exist within a data model definition. This search is looking specifically at the Splunk_SA_CIM (Splunk Common Information Model (CIM)) App, so in order for it to work you need to have this app installed.
0 comments
[0]
[0]
[0]
[0]
Sign in or Register to submit a comment