Common Information Model (CIM) normalizing data sources in splunk

Common Information Model Add-on Manual

Default values in the Splunk data model

Splunk Docs

Splunk Add-on Builder

Splunk Add-on Builder | Splunkbase