Splunk_Deploiement/apps/trackme/lookups/trackme_cim_recommended_fields.csv

1	field	is_recommended
2	action	true
3	src	true
4	src_ip	true
5	dest	true
6	dest_ip	true
7	dest_mac	true
8	signature	true
9	category	true
10	file_name	true
11	file_path	true
12	user	true
13	protocol	true
14	query	true
15	answer	true
16	recipient	true
17	src_user	true
18	query_type	true
19	message_type	true
20	app	true
21	lease_duration	true
22	bytes_in	true
23	bytes_out	true
24	http_content_type	true
25	http_method	true
26	http_user_agent	true
27	status	true
28	url	true
29	vendor_product	true