SPL2 modules for Palo Alto Networks logs¶
SPL2 modules are reusable SPL2 functions generated from the add-on’s existing knowledge objects, such as props.conf and transforms.conf.
Unlike SPL2 templates, which are end-to-end pipelines, SPL2 modules are intended to provide reusable sourcetype-specific logic that can be referenced from SPL2 workflows.
Note
After you install or upgrade the Splunk Add-on for Palo Alto Networks, SPL2 modules can take a short time to appear in the product experience while they are compiled.
Module types¶
As of now, the Splunk Add-on for Palo Alto Networks provides the following module type:
- Field-extraction modules
Field-extraction modules¶
Field-extraction modules preserve sourcetype-specific field extraction, normalization, calculated-field, and lookup behavior in reusable SPL2 form.
pan:traffic¶
Use the pan:traffic field-extraction module for traffic events collected from Palo Alto Networks firewalls. This module applies CSV extraction, field aliases, calculated fields, and lookup enrichments for traffic logs.
| Module name | Version | Use case | Availability |
|---|---|---|---|
| Palo Alto Networks pan:traffic logs: Field extractions module | 0.1.0 | Preserve the Splunk Add-on for Palo Alto Networks pan:traffic sourcetype field-extraction behavior in reusable SPL2 form generated from add-on knowledge objects. |
SPL2 workflow |
pan:threat¶
Use the pan:threat field-extraction module for threat, URL, vulnerability, wildfire, spyware, file, and virus events. This module applies field extraction, CIM normalization, lookup enrichments, and whitespace trimming for selected threat fields.
| Module name | Version | Use case | Availability |
|---|---|---|---|
| Palo Alto Networks pan:threat logs: Field extractions module | 0.1.0 | Preserve the Splunk Add-on for Palo Alto Networks pan:threat sourcetype field-extraction behavior in reusable SPL2 form generated from add-on knowledge objects. |
SPL2 workflow |
pan:traffic:cloud¶
Use the pan:traffic:cloud field-extraction module for traffic events from cloud-delivered Palo Alto Networks log data. This module applies field extraction, normalization, calculated fields, lookup enrichments, and JSON flattening for nested cloud log data.
| Module name | Version | Use case | Availability |
|---|---|---|---|
| Palo Alto Networks pan:traffic:cloud logs: Field extractions module | 0.1.0 | Preserve the Splunk Add-on for Palo Alto Networks pan:traffic:cloud sourcetype field-extraction behavior in reusable SPL2 form generated from add-on knowledge objects. |
SPL2 workflow |