Data Models & CIM

Data models are hierarchical structures that describe datasets. They organize fields into object hierarchies that Pivot (a drag-and-drop visualization tool) can use.

The Common Information Model (CIM) is a set of standardized data models provided by Splunk. CIM ensures that data from different sources uses consistent field names (e.g., "src_ip" for source IP across all security data).

CIM normalization is critical for apps like Splunk Enterprise Security (ES), which rely on consistent field names across all data sources.