transform field extraction

transform field extraction

noun

A type of extraction that allows you to use a single regular expression across multiple hosts, sources, or source types, or apply multiple regular expressions to a single host, source, or source type. You can find information about when to use transform field extractions in the Configure custom fields at search time topic.

Related terms

• automatic key-value field extraction
• inline field extraction

For more information

In the Knowledge Manager Manual:

• Use the field extractions page in Splunk Web
• Use the field transformations page in Splunk Web
• Configure custom fields at search time
• Configure advanced extractions with field transforms

In Getting Data In:

• Create custom fields at index time

In the Admin Manual:

• props.conf
• transforms.conf