SPL2 templates and modules for Amazon Web Services logs¶
SPL2 content for the Splunk Add-on for Amazon Web Services currently includes two artifact types:
- Templates, which are end-to-end SPL2 pipelines for transforming, reducing, extracting fields from, or generating metrics from log data.
- Field-extraction modules, which are reusable SPL2 functions generated from add-on knowledge objects such as
props.confandtransforms.conf.
Templates and modules are available for the Edge Processor and Ingest Processor. See the following documentation for more information:
Templates¶
Field-extraction pipeline templates¶
Field-extraction pipeline templates are end-to-end pipelines generated from the add-on’s knowledge objects for specific sourcetypes.
| Template name | Version | Supported sourcetype | Use case | Availability |
|---|---|---|---|---|
| AWS CloudTrail Event Extractions: Extract AWS CloudTrail Event Log Fields | 0.1.0 | aws:cloudtrail |
Preserve the Splunk Add-on for Amazon Web Services aws:cloudtrail field-extraction behavior in an end-to-end SPL2 pipeline. |
Edge Processor and Ingest Processor |
| AWS CloudWatch logs: Events Field Extractions | 0.1.0 | aws:cloudwatch |
Preserve the Splunk Add-on for Amazon Web Services aws:cloudwatch field-extraction behavior in an end-to-end SPL2 pipeline. |
Edge Processor and Ingest Processor |
| AWS CloudWatch Logs VPC Flow: Events Field Extractions | 0.1.0 | aws:cloudwatchlogs:vpcflow |
Preserve the Splunk Add-on for Amazon Web Services aws:cloudwatchlogs:vpcflow field-extraction behavior in an end-to-end SPL2 pipeline. |
Edge Processor and Ingest Processor |
Metrics templates¶
| Template name | Version | Supported sourcetype | Use case | Availability |
|---|---|---|---|---|
| AWS VPC Flow logs: Filter unwanted logs and generate metrics from logs | 0.0.1 | aws:cloudwatchlogs:vpcflow:metric |
Generate metrics with dimensions and filter some events from VPC Flow logs. | Edge Processor and Ingest Processor |
Reduction templates¶
| Template name | Version | Supported sourcetype | Use case | Availability |
|---|---|---|---|---|
| AWS CloudTrail Logs: Reduce log size | 0.0.1 | aws:cloudtrail |
Reduce the size of AWS CloudTrail logs by removing unnecessary fields while sending untouched logs to a lower priority destination. | Edge Processor and Ingest Processor |
See the Release notes for SPL2 template and module release notes.
Modules¶
For information about available SPL2 modules, see the SPL2 modules overview.