splunk-cim

列出目前系統中有的 CIM
- 於 web 中 search | datamodelsimple type=models
確定要符合那種 data model
- 可由 “Splunk Common Information Model” App 來看
- http://localhost:8000/en-US/app/Splunk_SA_CIM/cim_setup?action=edit
- https://docs.splunk.com/Documentation/CIM/4.18.0/User/Overview => 也可由這邊選 data models
接著設定 data model
- 由 Settings -> Data models -> 選對應的 data model
- 進行 tag 的設定
  - 由 Settings -> Event Types 進行新增
  - 透過設定檔, app/default/tags.conf
建立需要的 lookup table
- 可以由 | inputlookup lookup_defintion 可以看到 lookup 的定義
- 定義 lookup table
- 設定 lookup 欄位定義
設定 lookup 欄位的步驟
- 建立 & copy csv 檔案
  - 檔案放置於, app/lookup 目錄中
- 定義 lookup define 資料
  - 編輯檔案，app/default/transforms.conf
- 使用 lookup 來 alias 欄位
  - 編輯檔案，app/default/props.conf
regex
- 可以由 regex101 (https://regex101.com/ ) 這個 site 來測試
進行 CIM validate 的工具
- SA-cim_validator
- 安裝時，無法由 splunk base 進行安裝。自行 copy to $SPLUNK/etc/apps 目錄中，手動安裝
  - hire-vladimir/SA-cim_vladiator

一些筆記

Two Knowledge Objects included in the CIM
- Tags
- Fields
Process for Tags
- Identity
  - identity the data model and dataset revelant to your event
- Observe
  - Which Tags are required for the dataset ?
  - Are there any constraints ?
- Apply
  - create event types and tag them with the appropriate tags
- Verify
  - verify the tags work as expected using Pivot tool
Process of Fields
- Compare the fileds in the data model with the fields in your data
- Map your fields name to the CIM filed names
  - Aliases
  - Extractions
  - Lookups
Two Way to validate your data
- using the Pivot editor
- searching the data model itself
Six steps in the data normalization pipeline
- get data in
- examine data
- tag events
- verify tags
- normalize field
- validate against data model