field transform

noun

A type of transform that is a component of a field extraction. The field transform is defined in transforms.conf and is referenced by a field extraction stanza in props.conf.

Field transforms contain a field-extracting regular expression and other attributes that govern the way that the transform extracts and formats field/value pairs. Field transforms are always created in conjunction with field extraction stanzas in props.conf; they do not stand alone.

All index-time field extractions require field transforms; search-time field extractions can be defined entirely within props.conf, or be set up to reference field transforms. Certain kinds of field extraction behavior for search-time field extractions can only be set up with the the help of field transforms.

You can manage field transforms in Manager through the Field Transformation page (which is used in conjunction with the Field Extraction page). Both of these pages are in the Fields section of Manager. You can also create and edit transforms directly within the transforms.conf file.

Related terms

For more information

In the Knowledge Manager Manual:

In the Getting Data In Manual:

In the Admin Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time