SPL2 modules for Cisco ASA logs

SPL2 modules are reusable SPL2 functions generated from the add-on’s existing knowledge objects, such as props.conf and transforms.conf.

Unlike SPL2 templates, which are end-to-end pipelines, SPL2 modules are intended to provide reusable sourcetype-specific logic that can be referenced from SPL2 workflows.

Note

After you install or upgrade the Splunk Add-on for Cisco ASA, SPL2 modules can take a short time to appear in the product experience while they are compiled.

Module types

As of now, the Splunk Add-on for Cisco ASA provides the following module type:

• Field-extraction modules

Field-extraction modules

Field-extraction modules preserve sourcetype-specific field extraction, normalization, calculated-field, and lookup behavior in reusable SPL2 form.

cisco:asa

Use the cisco:asa field-extraction module for Cisco ASA events. This module applies field extractions, field aliases, calculated fields, lookup enrichments, and whitespace trimming for selected fields.

Module name	Version	Use case	Availability
Cisco ASA cisco:asa logs: Field extractions module	0.1.0	Preserve the Splunk Add-on for Cisco ASA cisco:asa sourcetype field-extraction behavior in reusable SPL2 form generated from add-on knowledge objects.	SPL2 workflow