Skip to main content
Question

We want to CIM the fields, is there a way to do it?

  • Mar 11, 2025 3:14 AM UTC
  • 3 replies
  • 188 views

Hi TeamI hope you are doing well.We have been using Cribl to transform all our logs before they hit Splunk. We want to CIM the fields. Is there a way to do it?Thank you so much

    3 replies

    Jon Rust
    Forum|alt.badge.img
    • Jon Rust
    • Employee
    • Mar 11, 2025 4:36 AM UTC

    For sure. Cribl gives you complete control rename fields and/or move data around. It is not an easy button tho. You'll need to know your data and how it maps into CIM.I put together an example of this sort of thing in the Cisco ASA https://packs.cribl.io|pack

    Raanan Dagan

    Another good example is this pack:https://packs.cribl.io/ -> AWS VPC Flow for Security Teams

    • Taylor Mill
    • Author
    • Employee
    • Mar 11, 2025 4:36 AM UTC

    Thank you so much.

    Terms & ConditionsAccessibility statement