David Shpritz

Incorrect use of Network_Sessions CIM model

2

Per http://docs.splunk.com/Documentation/CIM/4.7.0/User/NetworkSessions the Network_Sessions DM is for DHCP and VPN traffic. The current version includes these eventtypes: [pan_traffic_start] search = sourcetype=pan_traffic OR sourcetype=pan:traffic AND log_subtype="start" #tags = network session start...

Suggest fields to remove from datamodel

19

So, because almost all of the data, including items which do not summarize well, are included in the data models, the data models that get created by this app are...