Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)
Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)
The Common Information Model (CIM) is a methodology for normalizing data, which is accurately described by statement A. It can indeed correlate data from different sources, making statement B correct as well. Statement C is also accurate because the CIM is used by Knowledge Managers to create knowledge objects such as reports. However, statement D is incorrect; CIM itself is not an app but rather an add-on that can interact with other apps on a single Splunk deployment. These statements clarify the role and functionality of the CIM within the Splunk ecosystem.
As others have said, A - Correct B - Correct Now for the interesting ones. C - CIM can create reports, which are a type of saved search, which are knowledge objects. Also, yes it is the knowledge manager's role: "you can use the models to generate reports", from the Knowledge Management docs https://docs.splunk.com/Documentation/Splunk/8.2.1/Knowledge/UnderstandandusetheCommonInformationModel - Correct D - Splunk's splexicon for add-on: "A type of app..." and the F2 pdf "The CIM add-on is a search time app..." https://docs.splunk.com/Splexicon:Addon - Correct ABCD is correct
Friends,finally ABC? could you please confirm this answer?
yes friend
Agree with Ajames21 - option D is incorrect because CIM is an add-on, not an app. So correct answer is ABC See this discussion on the differences between apps and add-ons: https://www.splunk.com/en_us/blog/tips-and-tricks/what-are-splunk-apps-and-add-ons.html and this page on the CIM add-on: https://splunkbase.splunk.com/app/1621/#/details (App Type is listed as Add-on, bottom right corner of Details tab)
This is a hard understandable and trick question. In my first read I thought it was ABC but after a while and doing some researches I end up with A and B. Here is my explanation: C - CIM is not a tool to create Knowledge OBjects. Knowledge manager use CIM to have a default start up of Knowledge OBjects. D - Despite Add-on be a TYPE of APP, add-on is not equal to an app. "Unlike an Add-on, App caters towards only a single perspective. It is used only for one common goal and it can be used for a specific thing." https://dev.splunk.com/enterprise/docs/welcome/?_gl=1*1x7ca1c*_ga*MjA0MTE4MDA2OC4xNjQzMDI4MzEx*_gid*OTYwNjk3ODMxLjE2NTEwNjgwMDE.&_ga=2.11612092.960697831.1651068001-2041180068.1643028311#What-is-a-Splunk-app https://dev.splunk.com/enterprise/docs/welcome/?_gl=1*1x7ca1c*_ga*MjA0MTE4MDA2OC4xNjQzMDI4MzEx*_gid*OTYwNjk3ODMxLjE2NTEwNjgwMDE.&_ga=2.11612092.960697831.1651068001-2041180068.1643028311#What-is-a-Splunk-add-on
AB for sure.. but I am not sure about C D is out (says CIM is an app but it is an add on) The issue with C is that CIM is used to normalize data and then that normalized data can be used to create reports (a knowledge object) - I don't think CIM itself can be used to create the knowledge objects.
Fun2(page 268) What is the Common Information Model (CIM)? • The Splunk Common Information Model provides a methodology to normalize data • Leverage the CIM when creating field extractions, field aliases, event types, and tags to ensure: – Multiple apps can co-exist on a single Splunk deployment – Object permissions can be set to global for the use of multiple apps – Easier and more efficient correlation of data from different sources and source types
It doesn't say it needs 3 answer, just A and B are the confirmed right answers.
"CIM is an app that can coexist with other apps on a single Splunk deployment" is not correct
A and B are correct D is incorrect as CIM is a framework that 'allows' apps to co-exist on a single instance
"The CIM add-on is a search time app..." so i guess D is kinda correct or am i mistaken? I would say A,B and D
A lot of different responses for this question! It seems to be ambiguously worded, i thought ABC was correct
ABC is correct A - Duh B - page 268 fundamentals 2 C - reports and dashboards are knowledge objects, https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtocreatereportsanddashboards D - CIM is an addon not an app, obvious trick wording https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview
Option D is really confusing, but according to page 268: CIM only helps to ensure – Multiple apps can co-exist on a single Splunk deployment.
ABCD are correct
Very ambigous question... I think AB is the correct answer for this question. C could be add but it's not the right answer for "describe the CIM" ?
Yes i somehow agree with you about the questions on describing instead of the usability
A different perspective but it is A, C and D for me A - yes B - no because the CIM is used to normalise, not to correlate C - yes D - yes, according to the Splexicon, an add-on is a type of app therefore D is correct
what is the correct answer? ABD or just AB