Common Information Model and Field Mapping Changes for the Splunk Add-on for JBoss¶
Version 3.0.0 of the Splunk Add-on for JBoss introduced Common Information Model (CIM) and field mapping changes to its sourcetypes. See the following sections for information on changes to the mapping.
Note
There are no CIM model or Field Mapping changes for jboss:jmx and jboss:gc:log sourcetype.
CIM model and Field Mapping changes for Jboss:server:log¶
See the following comparison tables for CIM model and field mapping changes for the jboss:server:log sourcetype.
CIM model comparison for versions 2.1.0 and 3.0.0¶
| Sourcetype | message_id | Previous CIM model | New CIM model |
|---|---|---|---|
jboss:server:log |
OPVDX001, WFLYSRV0055, WFLYSRV0056 | Alerts |
Field mapping comparison for versions 2.1.0 and 3.0.0¶
| Source-type | message_id, thread_name | Fields added | Fields removed |
|---|---|---|---|
jboss:server:log |
WFLYSRV0056, WFLYSRV0055, Controller Boot Thread | tag::eventtype, tag |
CIM model and Field Mapping changes for Jboss:access:log¶
See the following comparison tables for CIM model and field mapping changes for the jboss:access:log sourcetype.
CIM model comparison for versions 2.1.0 and 3.0.0¶
| Sourcetype | Previous CIM model | New CIM model |
|---|---|---|
jboss:access:log |
Web |
Field mapping comparison for versions 2.1.0 and 3.0.0¶
| Source-type | Fields added | Fields removed |
|---|---|---|
jboss:access:log |
dest, tag, src_ip, dest_port, bytes_out, vendor_product, category, eventtype, http_user_agent_length, bytes, tag::eventtype, src, url_domain, bytes_in, http_referrer_domain, action |