Palo Alto Networks pan:traffic logs: Field extractions module

Use case

Use this SPL2 module when you want to preserve the Splunk Add-on for Palo Alto Networks field-extraction behavior for pan:traffic data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Note

This module must not be used with Splunk indexes. It is intended only for exporting to data lakes.

Version 0.1.0

Version 0.1.0 of the Palo Alto Networks pan:traffic logs: Field extractions module was released with the Splunk Add-on for Palo Alto Networks SPL2 content update.

---

Module details

Compatibility

This module is compatible with Splunk Add-on for Palo Alto Networks v3.2.0.

Module description

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for the pan:traffic sourcetype, but in reusable SPL2 form.

The module applies CSV extraction, field aliases, calculated fields, and lookup enrichments for Palo Alto Networks traffic events.

Supported sourcetype

This module applies to events with the pan:traffic sourcetype.

Module outline

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
apply_kv_mode	Applies KV_MODE-based extraction behavior for the sourcetype when applicable.	No configuration options.
apply_extractions	Applies extraction behavior derived from REPORT, EXTRACT, and TRANSFORMS knowledge objects.	No configuration options.
apply_normalizations	Applies field alias behavior derived from FIELDALIAS knowledge objects.	No configuration options.
apply_calculations_on_fields	Applies calculated-field behavior derived from EVAL knowledge objects.	No configuration options.
apply_lookups	Applies lookup enrichments derived from LOOKUP knowledge objects when present.	No configuration options.
pan_traffic_field_extractions_function	Exported module function for pan:traffic events.	No configuration options.

Example usage

You can reference the exported function from a pipeline that targets pan:traffic events, for example:

import pan_traffic_field_extractions_function from pan_traffic_field_extractions_module

$pipeline = | from $source
            | pan_traffic_field_extractions_function
            | into $data_lake_destination