Overview

The Self-Healing Pipeline feature in the Splunk Ingest Monitoring app automatically detects when ingested data deviates from the Common Information Model (CIM), and provides AI-powered remediation.

When data fields are missing, incorrectly mapped, or contain invalid values, downstream workflows, such as Splunk Enterprise Security correlation searches, dashboards, and alerts, can fail without warning. The Self-Healing Pipeline identifies these issues early and guides you through the resolution process to ensure your security and analytics pipelines remain reliable.

Note: When you use these AI features, you acknowledge that some third-party systems utilize cross-region inferencing (CRIS). This may occasionally involve transferring your data to data centers outside your selected storage region. By proceeding, you consent to this transfer, ensuring that your data remains subject to all applicable privacy laws. For more information, see the Data Zone deployments and Region availability for Foundry Models sold by Azure topics in the Microsoft documentation.

What you can do with Self-Healing Pipelines

Use the Self-Healing Pipeline feature to perform the following tasks:

Detect CIM non-compliance

Monitor your data sources for missing fields, low field coverage, and incorrect field values as defined in CIM.
Get AI-powered remediation

Receive automatically generated fixes for your add-on configuration files, like props.conf and transforms.conf.
Review changes visually

Compare your current add-on configuration against the proposed fixes in a side-by-side difference view.
Preview new field extractions Preview which CIM fields will be extracted after the proposed fix is applied without installing the overlay add-on.
Download ready-to-install packages Download a corrected add-on overlay package that you can deploy directly to your Splunk platform environment.

Self-Healing Pipeline supports the following features:

Monitor and alert on non-compliance: Track sourcetypes mapped to the CIM and receive alerts when they do not meet compliance standards
Configure granular detection Detect non-compliance at the data model, dataset, and sourcetype levels for each alert rule.
Analyze and generate fixes Use AI to collect information, analyze non-compliance, and generate add-on overlays.
Install overlays manually Download and install add-on overlay packages directly to your environment.

The following terminolgy is used when working with self-healing pipelines.

Field coverage

Field coverage measures what percentage of events that contain a non-null value for a specific CIM field. For example, if 950 out of 1,000 Authentication events have a populated src field, the field coverage for "src" is 95%. Low field coverage indicates that a field is missing from many events, which can cause CIM-dependent searches and dashboards to return incomplete results.

CIM value validation

CIM value validation measures what percentage of a field's values match the expected values defined by the CIM. For example, action fields in the Authentication datamodel must be one of the following: success, failure, pending, error.

A low CIM value validation value means the field is present, but contains values that don't match the expected values. This can cause lookups and correlations to fail.

Add-on overlay
An add-on overlay is a supplementary Splunk app that adds or corrects field extractions, transformations, and evaluations that are defined in props.conf and transforms.conf. Instead of modifying your existing add-on directly, the overlay app layers its configuration on top, preserving your original add-on, while fixing the compliance issues.