AWS CloudWatch logs: Field extractions module¶

Use case¶

Use this SPL2 module when you want to preserve the Splunk Add-on for Amazon Web Services field-extraction behavior for aws:cloudwatch data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Version 0.1.0¶

Version 0.1.0 of the AWS CloudWatch logs: Field extractions module was released with the Splunk Add-on for Amazon Web Services SPL2 content update.

Module details¶

Compatibility¶

This module is compatible with Splunk Add-on for Amazon Web Services v8.2.0.

Module description¶

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for the aws:cloudwatch sourcetype, but in reusable SPL2 form.

This release also includes a related field-extraction pipeline template for aws:cloudwatch data.

Supported sourcetype¶

This module applies to events with the aws:cloudwatch sourcetype.

Module outline¶

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
`apply_kv_mode`	Applies `KV_MODE`-based extraction behavior for the sourcetype when applicable.	No configuration options.
`apply_extractions`	Applies regex-based extraction behavior derived from `REPORT`, `EXTRACT`, and `TRANSFORMS` knowledge objects.	No configuration options.
`apply_normalizations`	Applies field alias behavior derived from `FIELDALIAS` knowledge objects.	No configuration options.
`apply_calculations_on_fields`	Applies calculated-field behavior derived from `EVAL` knowledge objects.	No configuration options.
`apply_lookups`	Applies lookup enrichments derived from `LOOKUP` knowledge objects when present.	No configuration options.
`_flatten_json`	Flattens nested JSON data into top-level fields for downstream extraction logic.	No configuration options.
`aws_cloudwatch_field_extractions_function`	Exported module function for `aws:cloudwatch` events.	No configuration options.

Example usage¶

You can reference the exported function from a pipeline that targets aws:cloudwatch events, for example:

$pipeline = | from $source
            | aws_cloudwatch_field_extractions_function
            | into $destination