CIM

The Common Information Model (CIM) is a standardized data model developed by Splunk.

DataStream converts to CIM with the Normalize processor, which applies the field naming conventions described below. The data models are a Splunk-side construct: DataStream does not emit the tag and eventtype fields that assign events to a model, so model membership is determined in Splunk rather than at ingestion.

Common Fields:

Field Category	Fields	Description
Base Fields	time, source, host, vendor_product	Core fields for event identification and source tracking
Identity Fields	user, src_user, dest_user, src_user_id, dest_user_id	User identification and authentication tracking
Network Fields	src, src_ip, dest, dest_ip, src_port, dest_port	Network communication endpoints. source.ip and destination.ip each populate both the short and the _ip form

Data Models:

Model Type	Fields	Purpose
Authentication	action, app, status, user, src_user	Track authentication events and access control
Network Traffic	bytes, bytes_in, bytes_out, protocol, direction, duration, flags	Monitor network communications and traffic patterns
Intrusion Detection	severity, signature_id, category, vendor_product	Rule and detection identification

Splunk-side ingestion metadata — index and sourcetype — is assigned by Splunk on receipt and is not part of what the processor writes.