UNIX and Linux lsof logs: Field extractions module¶

Use case¶

Use this SPL2 module when you want to preserve the Splunk Add-on for Unix and Linux field-extraction behavior for lsof data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Version 0.1.0¶

Version 0.1.0 of the UNIX and Linux lsof logs: Field extractions module was released with the Splunk Add-on for Unix and Linux SPL2 content update.

Module details¶

Compatibility¶

This module is compatible with Splunk Add-on for Unix and Linux v10.3.0.

Module description¶

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculation, and lookup behavior that the add-on defines for the lsof sourcetype, but in reusable SPL2 form.

For the current lsof sourcetype, the add-on defines event breaking and KV_MODE handling, but it does not define additional REPORT, EXTRACT, FIELDALIAS, EVAL, or LOOKUP rules. As a result, the generated module is currently a reusable pass-through function that preserves the structure needed for future sourcetype-specific extraction logic.

Supported sourcetype¶

This module applies to events with the lsof sourcetype.

Module outline¶

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
`apply_kv_mode`	Applies `KV_MODE`-based extraction behavior for the sourcetype when applicable.	No configuration options.
`apply_extractions`	Applies regex-based extraction behavior derived from `REPORT`, `EXTRACT`, and `TRANSFORMS` knowledge objects when present.	No configuration options.
`apply_normalizations`	Applies field alias behavior derived from `FIELDALIAS` knowledge objects when present.	No configuration options.
`apply_calculations_on_fields`	Applies calculated-field behavior derived from `EVAL` knowledge objects when present.	No configuration options.
`apply_lookups`	Applies lookup enrichments derived from `LOOKUP` knowledge objects when present.	No configuration options.
`lsof_field_extractions_function`	Exported module function for `lsof` events. In the current release, this function acts as a pass-through wrapper because no additional `lsof` field extractions or enrichments are defined in the add-on knowledge objects.	No configuration options.

Example usage¶

You can reference the exported function from a pipeline that targets lsof events, for example:

$pipeline = | from $source
            | lsof_field_extractions_function
            | into $destination