transform

transform

noun

A configuration that causes transformation of event data. You use transforms in several situations, including to create field transforms, to define custom index-time field extractions, and to setup lookups.

You can also use transforms to route and filter data. For example, you can send data to alternative indexes, or you can mask sensitive event data, such as customer credit card numbers.

You configure transforms in transforms.conf, usually in conjunction with a configuration in props.conf.

For more information

In the Knowledge Manager Manual:

• Use the Field transformations page in Splunk Web
• Create and maintain search-time field extractions through configuration files

In Getting Data In:

• Create custom fields at index time

In Forwarding Data:

• Route and filter data