In the 4.2.0 version of the Common Information Model Add-on Manual, it states clearly the Web object name should be tagged by "web". However, in the actual data model downloaded from splunkbase, the Web root is constrained with sourcetype=iis*. Is this a bug or am I missing something?
I think you must be seeing some locally applied constraint -- there's nothing like that out of the box.
Where do you see the constraint 'sourcetype=iis*'.
I am using the latest version of CIM and my top level constraint is 'tag=web'.
That is strange. I have the latest version which is Version 4.2.0.