Onboarding data in splunk is already easy as pie!!!!! However, we can bring this process to a higher level, normalizing all data, extracting fields in line with Splunk Common Information Model, tagging our events. But why should we do it? What are the benefits? Let's discuss this in our next event and check why we should do a common practice.