Microsoft Windows Perfmon:Process logs: Field extractions module

Use case

Use this SPL2 module when you want to preserve the Splunk Add-on for Microsoft Windows field-extraction behavior for Perfmon:Process data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Version 0.1.0

Version 0.1.0 of the Microsoft Windows Perfmon:Process logs: Field extractions module was released with the Splunk Add-on for Microsoft Windows SPL2 content update.

---

Module details

Compatibility

This module is compatible with Splunk Add-on for Microsoft Windows v10.1.0.

Module description

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for the Perfmon:Process sourcetype, but in reusable SPL2 form.

Supported sourcetype

This module applies to events with the Perfmon:Process sourcetype.

Module outline

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
apply_kv_mode	Applies KV_MODE-based extraction behavior for the sourcetype when applicable.	No configuration options.
apply_extractions	Applies regex-based extraction behavior derived from REPORT, EXTRACT, and TRANSFORMS knowledge objects.	No configuration options.
apply_normalizations	Applies field alias behavior derived from FIELDALIAS knowledge objects.	No configuration options.
apply_calculations_on_fields	Applies calculated-field behavior derived from EVAL knowledge objects.	No configuration options.
apply_lookups	Applies lookup enrichments derived from LOOKUP knowledge objects when present.	No configuration options.
Perfmon_Process_field_extractions_function	Exported module function for Perfmon:Process events.	No configuration options.

Example usage

You can reference the exported function from a pipeline that targets Perfmon:Process events, for example:

$pipeline = | from $source
            | Perfmon_Process_field_extractions_function
            | into $destination