Splunk Core Certified Power User — Question 152

What needs to be configured in order to normalize data using the Splunk Common Information Model (CIM) Add-On?

Answer options

• A. Configure workflow actions for the event types.
• B. Configure the correct sourcetypes for the data models.
• C. Configure event types that reference the appropriate tags.
• D. Configure field aliases to match tags in the data models.

Correct answer: C

Explanation

The correct answer is C because configuring event types to reference the appropriate tags is essential for data normalization within the CIM framework. Options A, B, and D, while important for other configurations, do not directly contribute to the normalization process as defined by the CIM Add-On.