I have a existing dlp data model, Can we add the indexed dlp data to exisiting one to make a cim compliant OR we need to create a new datamodel to add the data? I want to check the netscope addon in props. But i am on splunk cloud how do I look for the app props and transform conf files from GUI? Hi, gcusello richgalloway Even after dlp data is added to the dlp datamodel, I didnt see any dlp incidents in the datamodel, what could be the problem here?
The next step is install one or more TAs to extract fields from the data. Search splunkbase apps. Follow the instructions there to install the TA.
If you still aren't getting fields extracted from your data then either you have the wrong TA or you need an additional TA. You may need to create your own TA if one does not exist in splunkbase. Have you confirmed the sourcetype in your inputs.
And one more thing i can Tstats to some fields of the datamodel inspite of getting one event when I search DLP datamodel. Splunk Cloud users do not have file system access, but they still have access to config files through the apps they install. Yes, "TA" and "add-on" mean the same thing.
A TA is a Technical Add-on and is a term used to describe an app that help onboard data, typically by extracting fields.
