SPLK-3001: Splunk Enterprise Security Certified Admin (Legacy)Demo

By Splunk · Question Mode

QuestionQ94

Custom Add-ons

After you manage source types and extract fields, which key step follows in the Add-On Builder?

  • A Configure data collection.
  • B Validate and package.
  • C Create alert actions.
  • D Map to data models.
Explanation

After source types and field extractions are defined, the add-on’s events are mapped to the appropriate Common Information Model (CIM) data models so their fields and event classifications conform to Splunk’s normalized data model. Use the CIM to normalize data at search time

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!