Using the Common Information Model (CIM) for Splunk Core Certified Power User

Sample Practice Questions

1. Question 1

   By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?
   1. A. Turned off.
   2. B. Turned on.
   3. C. Determined automatically based on the sourcetype.
   4. D. Determined automatically based on the data source.
   Explanation

   The correct answer is: A. Turned off..

   The data models bundled with the Common Information Model add-on ship with acceleration turned off, and enabling it is a deliberate administrative decision made per model after installation. Acceleration builds and maintains a persistent summary of a model's indexed data, which consumes disk on the indexers and adds ongoing background search load, so switching every model on by default would impose that cost on deployments that only use a handful of them. The recommended practice is to accelerate only the models you actually search or pivot against, and to constrain each summary range to the period your reporting genuinely covers. Acceleration is never inferred from the sourcetype or from where the data originated; those properties describe how data was onboarded and have no bearing on whether a summary is maintained. The setting lives on each data model's definition and is edited through Settings > Data models.

2. Question 2

   Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)
   1. A. CIM is a methodology for normalizing data.
   2. B. CIM can correlate data from different sources.
   3. C. The Knowledge Manager uses the CIM to create knowledge objects.
   4. D. CIM is an app that can coexist with other apps on a single Splunk deployment.
   Explanation

   The correct answers are: A. CIM is a methodology for normalizing data., B. CIM can correlate data from different sources., C. The Knowledge Manager uses the CIM to create knowledge objects..

   The Common Information Model is best understood as a methodology and a shared vocabulary rather than a piece of software, which is why it is described as a normalization approach: it prescribes the field names, event category tags, and data model structures that data from any vendor should conform to. Because unrelated products end up expressing the same concept with the same field names once normalized, the model directly enables correlation across systems, letting one search span a firewall, a proxy, and an endpoint agent without per-product field mapping. Knowledge managers rely on it when building knowledge objects, using its reference tables to decide which aliases, calculated fields, event types, and tags a new data feed needs so it lands correctly in the relevant models. The statement that does not describe the model itself is the framing of it as an app coexisting with other apps; that describes the add-on which packages and delivers the model, whereas the model is the schema and methodology the add-on implements.

3. Question 3

   Which Knowledge Object does the Splunk Common Information Model (CIM) use to normalize data, in addition to field aliases, event types, and tags?
   1. A. Macros
   2. B. Lookups
   3. C. Workflow actions
   4. D. Field extractions
   Explanation

   The correct answer is: B. Lookups.

   The Common Information Model add-on normalizes vendor-specific data into a shared schema using a small set of knowledge objects, and lookups are the fourth alongside field aliases, event types, and tags. Lookups perform the value-level translation that aliases cannot: an alias renames a vendor's field to the CIM field name, but only a lookup can map that vendor's proprietary values onto the values the CIM expects, such as translating numeric status codes into the model's success and failure strings. Field extractions are not part of this set, because extraction is the job of the technology add-on that onboards the data; by the time the CIM applies, fields are assumed to exist and need only renaming and value normalization. Macros package reusable SPL fragments and produce no normalized fields at all. Workflow actions add interactive links and secondary searches to the event viewer and play no part in shaping data to a schema.

4. Question 4

   Which of the following data models are included in the Splunk Common Information Model (CIM) add-on? (Choose all that apply.)
   1. A. Alerts
   2. B. Email
   3. C. Databases
   4. D. User permissions
   Explanation

   The correct answers are: A. Alerts, B. Email, C. Databases.

   Alerts, Email, and Databases are all data models shipped with the Common Information Model add-on. The Alerts model normalizes alarm and notification events from monitoring platforms, Email covers message metadata such as sender, recipient, and subject from mail gateways, and Databases captures instance, query, and lock statistics from database technologies. Each arrives as a preconfigured model with documented field expectations and tag-based constraints, so any technology add-on that tags its events correctly populates the matching model automatically. User permissions is not among the shipped models; permission and privilege activity is normalized by the Change data model, which tracks modifications to accounts, groups, and configurations alongside other change events. The full list also includes areas such as Authentication, Endpoint, Malware, Network Traffic, Vulnerabilities, and Web, each documented with its own field reference in the add-on's manual.

5. Question 5

   Which of the following is a function of the Splunk Common Information Model (CIM)?
   1. A. Normalizing data across a Splunk deployment.
   2. B. Providing templates for reports and dashboards.
   3. C. Algorithmically shifting events to other indexes.
   4. D. Reingesting previously indexed data with new field names.
   Explanation

   The correct answer is: A. Normalizing data across a Splunk deployment..

   The function of the Common Information Model is to normalize data across a deployment, meaning it defines a single set of field names, event category tags, and model structures that every data feed is mapped onto so that searches no longer need to know each product's native vocabulary. Once a feed is normalized, a search for failed authentication works identically whether the events came from a domain controller, a VPN appliance, or a Linux host. Providing report and dashboard templates is not its function; that is what apps such as Enterprise Security build on top of normalized data, and those apps depend on the model rather than constituting it. Nothing in the model shifts events between indexes, since normalization is applied at search time and leaves indexed data exactly where it was written. It also does not reingest data under new field names; the original events remain untouched on disk and renaming happens through search-time knowledge objects such as field aliases.

Other Splunk Core Certified Power User domains

• Correlating Events (24 questions)
• Creating and Managing Fields (21 questions)
• Creating and Using Macros (20 questions)
• Creating and Using Workflow Actions (25 questions)
• Creating Data Models (27 questions)
• Creating Field Aliases and Calculated Fields (22 questions)
• Creating Tags and Event Types (21 questions)
• Filtering and Formatting Results (27 questions)
• Using Transforming Commands for Visualizations (19 questions)