splunk-cim-data-model-setup

Render and apply CIM data model governance configurations for Splunk.

36|7|Updated Mar 17, 2026

Search Tags:#governance #data-model #render #splunk #cim #acceleration #eventtype

Ready to run

npx skills add https://github.com/chambear2809/splunk-cisco-skills --skill splunk-cim-data-model-setup

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: splunk-cim-data-model-setup
Source: https://github.com/chambear2809/splunk-cisco-skills/tree/main/skills/splunk-cim-data-model-setup
Command: npx skills add https://github.com/chambear2809/splunk-cisco-skills --skill splunk-cim-data-model-setup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

CIM data governance for CIM models is complex, requiring coordinated rendering of configuration assets, safe apply procedures, and validation to keep data models CIM-compliant while minimizing resource usage.

Core Features & Use Cases

Render acceleration governance (datamodels.conf, macros.conf) for a CIM data model.
Map CIM eventtypes, apply index constraints, and validate with tstats via a generated script.
Use for both standard CIM models and custom data models within Splunk_SA_CIM.

Quick Start

Render CIM data model governance for a model using the setup script.

Frequently Asked Questions about splunk-cim-data-model-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I apply acceleration and index constraints to Splunk CIM data models?▼

To apply acceleration and index constraints to Splunk CIM data models, you can render datamodels.conf and macros.conf configurations. This coordinates all governance assets and safety checks during the apply procedure.

How do I map eventtypes and validate CIM compliance for custom Splunk data models?▼

Mapping eventtypes and validating CIM compliance involves applying index constraints and running tstats validation via a generated script. This ensures both standard and custom data models within Splunk_SA_CIM remain compliant.

What is CIM data model governance and when do I need to render it in Splunk?▼

CIM data model governance is the coordinated rendering and validation of configuration assets to keep data models CIM-compliant while minimizing resource usage. It is needed when applying acceleration or eventtype mappings to Splunk CIM models.

Can I use this setup script for custom data models within Splunk_SA_CIM?▼

Yes, the setup script supports both standard CIM models and custom data models within Splunk_SA_CIM. It renders acceleration governance and maps eventtypes while validating outputs through generated configuration files.

What's the best way to validate CIM data model acceleration configurations after applying them?▼

The best way to validate CIM data model acceleration is by examining generated configuration files and running the included validation script. This validates outputs by testing tstats queries against the applied index constraints and eventtype mappings.

Why does CIM data governance require coordinated rendering of configuration assets in Splunk?▼

CIM data governance requires coordinated rendering because data models need synchronized datamodels.conf, macros.conf, and eventtype mappings. Safe apply procedures and validation prevent resource exhaustion and maintain CIM compliance.