What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
A . Custom visualizations
B . Pre-configured data models
C . Fields and event category tags
D . Automatic data model acceleration

View Answer

Answer: BC

Explanation:

The Splunk Common Information Model (CIM) add-on is a collection of pre-built data models and knowledge objects that help you normalize your data from different sources and make it easier to analyze and report on it3. The CIM add-on includes pre-configured data models that cover various domains such as Alerts, Email, Database, Network Traffic, Web and more3. Therefore, option B is correct. The CIM add-on also includes fields and event category tags that define the common attributes and labels for the data models3. Therefore, option C is correct. The CIM add-on does not include custom visualizations or automatic data model acceleration. Therefore, options A and D are incorrect.