SPL2 templates and modules for Unix and Linux logs¶
SPL2 content for Unix and Linux currently includes two artifact types:
- Size-reduction templates, which are end-to-end SPL2 pipelines for reducing log volume.
- Field-extraction modules, which are reusable SPL2 functions generated from add-on knowledge objects such as
props.confandtransforms.conf.
The size-reduction templates are available for the Edge Processor and Ingest Processor. See the following documentation for more information:
Templates¶
Noise reduction¶
| Template name | Version | Use case | Availability |
|---|---|---|---|
| UNIX and Linux bandwidth logs: Reduce log size and convert to TSV format | 0.2.1 | Reduce the size of Unix and Linux bandwidth logs by removing unnecessary fields and converting logs into a tab-separated values (TSV) format while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux cpu logs: Reduce log size and convert to TSV format | 0.4.2 | Reduce the size of Unix and Linux cpu logs by removing unnecessary fields and converting logs into a tab-separated values (TSV) format while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux df logs: Reduce log size and convert to TSV format | 0.4.1 | Reduce the size of Unix and Linux df logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux hardware logs: Reduce log size and convert to tab-separated key-value pair format | 0.4.1 | Reduce the size of Unix and Linux hardware logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux interfaces logs: Reduce log size and convert to TSV format | 0.4.1 | Reduce the size of Unix and Linux interfaces logs by removing unnecessary fields, replacing invalid values, and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux iostat logs: Reduce log size and convert to TSV format | 0.4.1 | Reduce the size of Unix and Linux iostat logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux lastlog logs: Reduce log size and convert to TSV format | 0.2.0 | Reduce the size of Unix and Linux lastlog logs by converting them to tab-separated values (TSV) format and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux lsof logs: Reduce log size and convert to TSV format | 0.4.3 | Reduce the size of Unix and Linux lsof logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux netstat logs: Reduce log size and convert to TSV format | 0.4.1 | Reduce the size of Unix and Linux netstat logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux package logs: Reduce log size and convert to TSV format | 0.4.2 | Reduce the size of Unix and Linux package logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux ps logs: Reduce log size and convert to TSV format | 0.4.2 | Reduce the size of Unix and Linux ps logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux top logs: Reduce log size and convert to TSV format | 0.4.2 | Reduce the size of Unix and Linux top logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
| UNIX and Linux vmstat logs: Reduce log size and convert to tab-separated key-value pair format | 0.3.1 | Reduce the size of Unix and Linux vmstat logs by removing unnecessary fields and optimizing log storage while maintaining compatibility with the Splunk Common Information Model (CIM). |
Edge Processor and Ingest Processor |
Release notes for the templates are available in the documentation.
Modules¶
For information about available SPL2 modules, see the SPL2 modules overview.