Limitations of Self-Healing Pipelines
Self-Healing Pipelines have the following limitations:
| Detection scope limitations |
Detection is limited to data models, fields, and validation rules defined in the Splunk Common Information Model . Custom data models and custom fields are not supported. The system identifies missing fields and CIM value validation. It doesn't evaluate whether a field's value is semantically reasonable for that field. For example, the system does not verify that a user field follows an expected format such as an email address, account name, MAC address, or IP-like identifier. It checks only whether the value violates explicit prescribed values defined in the CIM. Detection operates at the You must enable CIM Data Model Acceleration for each data model you want to monitor. Without acceleration, you can't create alert rules. The system uses the acceleration summary to identify available data sources, or source types. When data model acceleration is off, the acceleration summary is empty, which prevents alert creation for that data model. Self-Healing Pipeline uses static alert thresholds rather than relative or anomaly-based detection. Because not every event is expected to have all CIM fields extracted, static thresholds might produce false positives in some environments. |
| AI remediation limitations |
The system collects one problematic sample event from each event type in the target data source and passes it to the AI for analysis. While the system attempts to fetch a broad set of events, it might not capture all event variations. This means the AI might address only part of the problem, and you might need multiple iterations to resolve all non-compliant event types. The AI has access only to props.conf and transforms.conf. It cannot inspect other extraction mechanisms, such as automatic lookups or lookup table contents, and attempts to infer mappings based on available configuration. You can only review AI-generated fixes before downloading them. To update the AI-generated fixes, open and edit the files in a text editor. |
| AI token limitations | AI token limits and other resource constraints are located at the Splunk tenant level and not tracked at the service/product level.
LLMs (per stack, uniform):
|
Overlay add-on compatibility with other add-ons
When a vendor releases an updated version of an add-on that natively resolves Common Information Model (CIM) issues, your existing overlay add-on may continue to override the updated add-on's files. This persistence can result in configuration conflicts.
Before upgrading a vendor add-on, review the vendor's release notes to confirm whether the original CIM parsing issues have been natively resolved.
| Scenario | Action |
|---|---|
| Release notes confirm all CIM fields that are patched by the overlay add-on, are now natively fixed. | Safe to remove the overlay add-on. Uninstall to avoid configuration conflicts. |
| Release notes confirm some CIM fields patched by the overlay are natively fixed | Keep the overlay add-on installed. Removing it will re-expose the fields the vendor has not yet fixed. |
| Release notes confirm no CIM fields patched by the overlay are natively fixed. | Keep the overlay add-on installed. The vendor update does not address the CIM issues. |
For more information, see the Install apps on your Splunk Cloud Platform deployment topic in the Splunk Cloud Platform admin manual.
- Field coverage
-
Field coverage measures what percentage of events that contain a non-null value for a specific CIM field. For example, if 950 out of 1,000 Authentication events have a populated
srcfield, the field coverage for "src" is 95%. Low field coverage indicates that a field is missing from many events, which can cause CIM-dependent searches and dashboards to return incomplete results. - CIM value validation
-
CIM value validation measures what percentage of a field's values match the expected values defined by the CIM. For example, action fields in the Authentication datamodel must be one of the following: success, failure, pending, error.
A low CIM value validation value means the field is present, but contains values that don't match the expected values. This can cause lookups and correlations to fail.
- Add-on overlay
-
An add-on overlay is a supplementary Splunk app that adds or corrects field extractions, transformations, and evaluations that are defined in
props.confandtransforms.conf. Instead of modifying your existing add-on directly, the overlay app layers its configuration on top, preserving your original add-on, while fixing the compliance issues.