Self-Healing Pipelines overview

Learn how the Self-Healing Pipeline feature in the Ingest Monitoring app detects CIM non-compliance and helps you review and resolve field issues.

The Self-Healing Pipeline feature in the Ingest Monitoring app detects when ingested data doesn't conform to the Common Information Model (CIM). It uses AI to analyze non-compliance and generate add-on overlays with proposed fixes.

Missing fields, incorrect field mappings, or values that don't conform to CIM can affect downstream workflows, including Splunk Enterprise Security correlation searches, dashboards, and alerts. The Self-Healing Pipeline feature helps you identify these issues and review proposed fixes.

Note:

When you use these AI features, you acknowledge that some third-party systems utilize cross-region inferencing (CRIS). This may occasionally involve transferring your data to data centers outside your selected storage region. By proceeding, you consent to this transfer, ensuring that your data remains subject to all applicable privacy laws. For more information, see the Microsoft documentation for data zone deployments and model availability by region.

What the Self-Healing Pipeline feature does

Use the feature to monitor CIM compliance, analyze issues, review proposed changes, and install add-on overlays.

Table 1. Capabilities and descriptions
Capability Description
Monitor CIM compliance Monitor source types mapped to CIM for missing fields, low field coverage, and values that don't conform to CIM. Configure detection by data model, dataset, and source type in each alert rule.
Analyze issues and generate fixes Use AI to analyze non-compliance and generate add-on overlays with proposed fixes for configuration in props.conf and transforms.conf.
Review and preview changes Compare the current add-on configuration with proposed fixes in a side-by-side view. Preview the CIM fields that the fix extracts without installing the overlay.
Download and install overlays Download a corrected add-on overlay package and install it in your Splunk environment.

Self-Healing Pipeline terminology

Field coverage

Field coverage is the percentage of events that have a non-null value for a specific CIM field. For example, if 950 of 1,000 Authentication events have a non-null src value, the field coverage for src is 95%. Low field coverage means that many events are missing a value for the field, which can cause CIM-dependent searches and dashboards to return incomplete results.

CIM value validation

CIM value validation is the percentage of a field's values that match the expected values defined by CIM. For example, the action field in the Authentication data model must contain one of these values: success, failure, pending, or error.

A low CIM value validation percentage means that the field is present, but its values don't match the expected values. This can cause lookups and correlations to fail.

Add-on overlay

An add-on overlay is a supplementary Splunk app that layers configuration on top of an existing add-on. It can add or correct field extractions, transformations, and evaluations defined in props.conf and transforms.conf. The overlay lets you apply these changes without modifying the original add-on.