The default mechanism represented by the question is the tag field. CIM data-model datasets use constraints that commonly depend on tags applied through event types and other Splunk knowledge objects to determine whether events belong to a particular semantic dataset.
For example, events associated with a particular CIM category can be tagged so that the corresponding dataset constraint recognizes them. The underlying vendor data may originate from many different sourcetypes, but the CIM abstraction allows all correctly classified and normalized records to participate in a common data model.
A sourcetype remains extremely important because it identifies the format and parsing context of indexed data, but CIM is intentionally designed to support multiple vendors and sourcetypes within the same semantic dataset. Consequently, sourcetype alone is not the default abstraction requested here. source identifies the origin of data and similarly does not define CIM dataset membership. dataset is not the event field used by default for this routing behavior.
Correct tagging must be combined with proper CIM field normalization for downstream searches to produce meaningful standardized results.
Study Guide topics: CIM tags, dataset constraints, event types, CIM normalization, data-model membership, sourcetypes.
