Data Model Not Building with CIM 4.7/4.8

[farriesk]

We have a requirement for CIM 4.7/4.8 and it seems that the Palo Alto App has an issue with this version.

Is this an issue with CIM or is there something we can do around resolving it?

The data model acceleration building was at 99% for days and then we disabled and enabled acceleration and now it will not go past 53%.

Thanks in advance.

[paulmnguyen]

Hi Farriesk,

Thank you for reaching out to us in regards to the CIM. I have tested the app and it does work with 4.8. It is likely that your data model acceleration never completes build due to insufficient compute resources on the server. You may want to reach out to the community to help you find a solution at https://www.splunk.com/en_us/community.html

Regards,

Paul Nguyen

[farriesk]

Thank you Paul for looking into this and you can close this issue. The reason I posted here is that Splunk support said the issue was that Palo Alto App was not compatible with CIM 4.7/4.8 and they recommended that I downgrade to CIM 4.6. I did mention to them that I did not agree with their answer and that I would post here.

[paulmnguyen]

Your welcome! Glad I could help. I have updated the app/Add-on on Splunk Base to show support for CIM 4.8.