AWS CloudWatch Logs VPC Flow logs: Field extractions module¶

Use case¶

Use this SPL2 module when you want to preserve the Splunk Add-on for Amazon Web Services field-extraction behavior for aws:cloudwatchlogs:vpcflow data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Version 0.1.0¶

Version 0.1.0 of the AWS CloudWatch Logs VPC Flow logs: Field extractions module was released with the Splunk Add-on for Amazon Web Services SPL2 content update.

Module details¶

Compatibility¶

This module is compatible with Splunk Add-on for Amazon Web Services v8.2.0.

Module description¶

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for the aws:cloudwatchlogs:vpcflow sourcetype, but in reusable SPL2 form.

This release also includes a related field-extraction pipeline template for aws:cloudwatchlogs:vpcflow data.

Supported sourcetype¶

This module applies to events with the aws:cloudwatchlogs:vpcflow sourcetype.

Module outline¶

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
`apply_kv_mode`	Applies `KV_MODE`-based extraction behavior for the sourcetype when applicable.	No configuration options.
`apply_extractions`	Applies regex-based extraction behavior derived from `REPORT`, `EXTRACT`, and `TRANSFORMS` knowledge objects.	No configuration options.
`apply_normalizations`	Applies field alias behavior derived from `FIELDALIAS` knowledge objects.	No configuration options.
`apply_calculations_on_fields`	Applies calculated-field behavior derived from `EVAL` knowledge objects.	No configuration options.
`apply_lookups`	Applies lookup enrichments derived from `LOOKUP` knowledge objects when present.	No configuration options.
`aws_cloudwatchlogs_vpcflow_field_extractions_function`	Exported module function for `aws:cloudwatchlogs:vpcflow` events.	No configuration options.

Example usage¶

You can reference the exported function from a pipeline that targets aws:cloudwatchlogs:vpcflow events, for example:

$pipeline = | from $source
            | aws_cloudwatchlogs_vpcflow_field_extractions_function
            | into $destination