I am creating an app in splunk with the concept of CIM in splunk and I am facing following challege for some use cases

[chandra1347215]

1. Some windows fields are not there in the Authentication datamodel like EventCode and logon_type.
2. I don't know how to map these windows fields in datamodel to get the data to get the benefit of data acceleration.

Please clarify these challenges if anyone know here.