Microsoft Windows WinRegistry logs: Field extractions module

Use case

Use this SPL2 module when you want to preserve the Splunk Add-on for Microsoft Windows field-extraction behavior for WinRegistry data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Version 0.1.0

Version 0.1.0 of the Microsoft Windows WinRegistry logs: Field extractions module was released with the Splunk Add-on for Microsoft Windows SPL2 content update.

---

Module details

Compatibility

This module is compatible with Splunk Add-on for Microsoft Windows v10.1.0.

Module description

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for the WinRegistry sourcetype, but in reusable SPL2 form.

Supported sourcetype

This module applies to events with the WinRegistry sourcetype.

Module outline

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
apply_kv_mode	Applies KV_MODE-based extraction behavior for the sourcetype when applicable.	No configuration options.
apply_extractions	Applies regex-based extraction behavior derived from REPORT, EXTRACT, and TRANSFORMS knowledge objects.	No configuration options.
apply_normalizations	Applies field alias behavior derived from FIELDALIAS knowledge objects.	No configuration options.
apply_calculations_on_fields	Applies calculated-field behavior derived from EVAL knowledge objects.	No configuration options.
apply_lookups	Applies lookup enrichments derived from LOOKUP knowledge objects.	No configuration options.
WinRegistry_field_extractions_function	Exported module function for WinRegistry events.	No configuration options.

Example usage

You can reference the exported function from a pipeline that targets WinRegistry events, for example:

$pipeline = | from $source
            | WinRegistry_field_extractions_function
            | into $destination