<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Log Source Onboarding

## Splunk Configuration Files

### props.conf

| Setting | Description |
|---|---|
| `TIME_FORMAT` | strftime format for timestamp extraction |
| `TIME_PREFIX` | String preceding the timestamp |
| `SHOULD_LINEMERGE` | Whether to merge multi-line events |
| `LINE_BREAKER` | Regex defining event boundaries |
| `TRUNCATE` | Max event size in bytes |
| `EXTRACT-<name>` | Inline regex field extraction |
| `FIELDALIAS-<name>` | CIM field aliasing |

### transforms.conf

| Setting | Description |
|---|---|
| `REGEX` | Field extraction regex |
| `FORMAT` | Output field format |
| `filename` | Lookup CSV file name |
| `match_type` | Lookup match strategy |

## Elastic Ingest Processors

| Processor | Purpose |
|---|---|
| `grok` | Pattern-based field extraction |
| `dissect` | Delimiter-based field extraction |
| `date` | Timestamp parsing |
| `geoip` | IP geolocation enrichment |
| `set` | Set static field values |
| `rename` | Rename fields to ECS |
| `convert` | Type conversion |

## Agent Script

```bash
# Analyze log sample format
node agent.js analyze /var/log/firewall/sample.log

# Validate CIM field mapping
node agent.js validate-mapping mappings/firewall_cim.json

# Generate props.conf stanza
node agent.js generate-props --sourcetype "custom:firewall:paloalto"

# Generate volume check queries
node agent.js check-volume --index firewall --sourcetype "custom:firewall:paloalto"
```
