Cisco ASA cisco:asa logs: Field extractions module

Use case

Use this SPL2 module when you want to preserve the Splunk Add-on for Cisco ASA field-extraction behavior for cisco:asa data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Note

This module must not be used with Splunk indexes. It is intended only for exporting to data lakes.

Version 0.1.0

Version 0.1.0 of the Cisco ASA cisco:asa logs: Field extractions module was released with the Splunk Add-on for Cisco ASA SPL2 content update.

---

Module details

Compatibility

This module is compatible with Splunk Add-on for Cisco ASA v6.1.0.

Module description

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for the cisco:asa sourcetype, but in reusable SPL2 form.

The module applies field extractions, field aliases, calculated fields, lookup enrichments, and whitespace trimming for selected fields such as Group, group, reason, action_msg, pitcher_msg, tcp_flag, and type.

Supported sourcetype

This module applies to events with the cisco:asa sourcetype.

Module outline

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
apply_kv_mode	Applies KV_MODE-based extraction behavior for the sourcetype when applicable.	No configuration options.
apply_extractions	Applies extraction behavior derived from REPORT, EXTRACT, and TRANSFORMS knowledge objects.	No configuration options.
apply_normalizations	Applies field alias behavior derived from FIELDALIAS knowledge objects.	No configuration options.
apply_calculations_on_fields	Applies calculated-field behavior derived from EVAL knowledge objects.	No configuration options.
apply_lookups	Applies lookup enrichments derived from LOOKUP knowledge objects when present.	No configuration options.
trim_whitespace	Trims leading and trailing whitespace from selected Cisco ASA fields.	No configuration options.
cisco_asa_field_extractions_function	Exported module function for cisco:asa events.	No configuration options.

Example usage

You can reference the exported function from a pipeline that targets cisco:asa events, for example:

import cisco_asa_field_extractions_function from cisco_asa_field_extractions_module

$pipeline = | from $source
            | cisco_asa_field_extractions_function
            | into $destination