Installing the OCSF CIM add-on

Install the Common Information Model (CIM) to normalize your data to match a common standard.
Follow these steps to install the OCSF CIM add-on:
Note: Install the OCSF-CIM add-on to your search heads only.
For more information on installing a Splunk add-on in different deployment scenarios, see:
  1. Download the OCSF CIM add-on from Splunkbase (splunkbase.splunk.com/app/6841).
  2. Install the OCSF-CIM add-on to your Splunk search heads only.