A configuration that causes transformation of event data. You use transforms in several situations, including to create field transforms, to define custom index-time field extractions, and to setup lookups.

You can also use transforms to route and filter data. For example, you can send data to alternative indexes, or you can mask sensitive event data, such as customer credit card numbers.

You configure transforms in transforms.conf, usually in conjunction with a configuration in props.conf.

For more information

In the Knowledge Manager Manual:

In Getting Data In:

In Forwarding Data: