Microsoft Windows WinEventLog logs: Field extractions module¶

Use case¶

Use this SPL2 module when you want to preserve the Splunk Add-on for Microsoft Windows field-extraction behavior for WinEventLog data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Version 0.1.0¶

Version 0.1.0 of the Microsoft Windows WinEventLog logs: Field extractions module was released with the Splunk Add-on for Microsoft Windows SPL2 content update.

Module details¶

Compatibility¶

This module is compatible with Splunk Add-on for Microsoft Windows v10.1.0.

Module description¶

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for WinEventLog data, but in reusable SPL2 form.

The module includes shared preprocessing logic, sourcetype-specific helpers, and exported functions for the supported WinEventLog patterns so that SPL2 workflows can apply the same behavior that the add-on knowledge objects define for classic Windows event log data.

Supported sourcetype¶

This module applies to events with the WinEventLog sourcetype with the following source:

WinEventLog:Microsoft-Windows-PrintService/Operational
WinEventLog:System
WinEventLog:Microsoft-Windows-Windows Defender/Operational
WinEventLog:Microsoft-Windows-PowerShell/Operational
WinEventLog:Application
WinEventLog:Security
WinEventLog:System:IAS
WinEventLog:ForwardedEvents

Module outline¶

The module consists of helper functions followed by exported functions for the supported sourcetypes.

Function name	Description	Configuration options
`WinEventLog_prep`	Applies shared field extraction, normalization, and calculated-field behavior used across `WinEventLog` data.	No configuration options.
`WinEventLog_Microsoft_Windows_PrintService_Operational`	Applies additional extraction and normalization behavior for `WinEventLog:Microsoft-Windows-PrintService/Operational` events.	No configuration options.
`WinEventLog_System`	Applies additional extraction and normalization behavior for `WinEventLog:System` events.	No configuration options.
`WinEventLog_Microsoft_Windows_Windows_Defender_Operational`	Applies additional extraction and normalization behavior for `WinEventLog:Microsoft-Windows-Windows Defender/Operational` events.	No configuration options.
`WinEventLog_Microsoft_Windows_PowerShell_Operational`	Applies additional extraction and normalization behavior for `WinEventLog:Microsoft-Windows-PowerShell/Operational` events.	No configuration options.
`WinEventLog_Application`	Applies additional extraction and normalization behavior for `WinEventLog:Application` events.	No configuration options.
`WinEventLog_Security`	Applies additional extraction and normalization behavior for `WinEventLog:Security` events.	No configuration options.
`WinEventLog_System_IAS`	Applies additional extraction and normalization behavior for `WinEventLog:System:IAS` events.	No configuration options.
`WinEventLog_ForwardedEvents`	Applies additional extraction and normalization behavior for `WinEventLog:ForwardedEvents` events.	No configuration options.
`apply_WinEventLog_lookups`	Applies shared lookup enrichments for supported `WinEventLog` data.	No configuration options.
`apply_WinEventLog_System_lookups`	Applies lookup enrichments specific to `WinEventLog:System` data.	No configuration options.
`apply_WinEventLog_Microsoft_Windows_Windows_Defender_Operational_lookups`	Applies lookup enrichments specific to Windows Defender operational events.	No configuration options.
`apply_WinEventLog_Application_lookups`	Applies lookup enrichments specific to `WinEventLog:Application` data.	No configuration options.
`apply_WinEventLog_Security_lookups`	Applies lookup enrichments specific to `WinEventLog:Security` data.	No configuration options.
`WinEventLog_field_extractions_function`	Exported module function for generic `WinEventLog` events.	No configuration options.
`WinEventLog_Microsoft_Windows_PrintService_Operational_field_extractions_function`	Exported module function for `WinEventLog:Microsoft-Windows-PrintService/Operational` events.	No configuration options.
`WinEventLog_System_field_extractions_function`	Exported module function for `WinEventLog:System` events.	No configuration options.
`WinEventLog_Microsoft_Windows_Windows_Defender_Operational_field_extractions_function`	Exported module function for `WinEventLog:Microsoft-Windows-Windows Defender/Operational` events.	No configuration options.
`WinEventLog_Microsoft_Windows_PowerShell_Operational_field_extractions_function`	Exported module function for `WinEventLog:Microsoft-Windows-PowerShell/Operational` events.	No configuration options.
`WinEventLog_Application_field_extractions_function`	Exported module function for `WinEventLog:Application` events.	No configuration options.
`WinEventLog_Security_field_extractions_function`	Exported module function for `WinEventLog:Security` events.	No configuration options.
`WinEventLog_System_IAS_field_extractions_function`	Exported module function for `WinEventLog:System:IAS` events.	No configuration options.
`WinEventLog_ForwardedEvents_field_extractions_function`	Exported module function for `WinEventLog:ForwardedEvents` events.	No configuration options.

Example usage¶

You can reference an exported function from a pipeline that targets WinEventLog events, for example:

$pipeline = | from $source
            | WinEventLog_field_extractions_function
            | into $destination