SPL2 modules for Microsoft Cloud Services logs¶
SPL2 modules are reusable SPL2 functions generated from the add-on’s existing knowledge objects, such as props.conf and transforms.conf.
Unlike SPL2 templates, which are end-to-end pipelines, SPL2 modules are intended to provide reusable sourcetype-specific logic that can be referenced from SPL2 workflows.
Note
After you install or upgrade the Splunk Add-on for Microsoft Cloud Services, SPL2 modules can take a short time to appear in the product experience while they are compiled.
Module types¶
As of now, the Splunk Add-on for Microsoft Cloud Services provides the following module type:
- Field-extraction modules
Field-extraction modules¶
Field-extraction modules preserve sourcetype-specific field extraction, normalization, calculated-field, and lookup behavior in reusable SPL2 form.
| Module name | Version | Use case | Availability |
|---|---|---|---|
| Microsoft Cloud Services Azure Security Alert logs: Field extractions module | 0.1.0 | Preserve the Splunk Add-on for Microsoft Cloud Services mscs:azure:security:alert sourcetype field-extraction behavior in reusable SPL2 form generated from add-on knowledge objects. |
SPL2 workflow |
| Microsoft Cloud Services Azure Security Recommendation logs: Field extractions module | 0.1.0 | Preserve the Splunk Add-on for Microsoft Cloud Services mscs:azure:security:recommendation sourcetype field-extraction behavior in reusable SPL2 form generated from add-on knowledge objects. |
SPL2 workflow |