By default, do data models in the CIM Add-on search across all indexes?

Data models in the CIM (Common Information Model) Add-on are designed to provide a unified, normalized representation of the data ingested into Splunk. By default, they are configured to search across all available indexes within the Splunk deployment. This capability allows users to generate insights and reports based on data from diverse sources without needing to specify particular indexes.

This broad search capability is crucial for users who want to create comprehensive visualizations and analyses that encompass various data types and origins, thereby maximizing the potential of Splunk for data exploration and reporting.

In contrast, when considering the other options, searching across specific indexes or depending on configuration would imply limitations that are not typical of the default behavior of data models in the CIM Add-on. This default configuration simplifies the user's experience, enabling them to focus on analyzing the data rather than managing index specifications.