Validator

The Validator checks a log field by field against the Splunk Common Information Model (CIM). It reports what is missing, which fields hold unexpected values, the fix, and which use cases are affected.

1. Pick a log and a data model, or leave Best fit.
2. Choose how many events and over what time.
3. Click Validate. Nothing in Splunk changes.
4. Open a failing field to see the fix. Chuka can write it for you.

The Validator, with the logs most use cases depend on.

The Dictionary tab lists every field of every data model, including custom ones. History keeps every run.