topic Re: Global Transforms in All Apps and Add-ons

Global Transforms

Marinus — Tue, 30 Mar 2010 14:53:48 GMT

How do you specify transforms that will be applied globally?

Re: Global Transforms

gkanapathy — Tue, 30 Mar 2010 20:07:52 GMT

I suggest you avoid doing this, but either:

Put it at the top of the props.conf file
Apply it to [source::...]

What are you trying to do with a global transform that you can't do with a more specific source, sourcetype, or host pattern match?

Re: Global Transforms

Lowell — Tue, 30 Mar 2010 22:43:22 GMT

To add to what gkanapathy said. I suggested against this. Especially the [source::...] option. Because, if you add this stanza, then all other source-based props settings will no longer match. This is because this is because all first stanza to match so everything else will be ignore. See the docs: http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf

In other words, if you have a log file /var/log/httpd/error_log, it will not be assigned the sourcetype of apache_error, and WinEventLog events will no longer be split apart properly, ...

Not that I've tried this to confirm the behavior, but it can't be good.

Re: Global Transforms

BobM — Fri, 11 Feb 2011 05:21:19 GMT

I'm not sure what he is doing but I am trying to mask out credit card numbers no matter where they appear in any log.
Putting it at the top of the file works for me.

Re: Global Transforms

Jason — Fri, 18 Feb 2011 02:31:41 GMT

A transform to pull information from a hostname and add fields accordingly (where the entire company conforms to a naming convention) would be useful for this as well, so it applies to all data.

Re: Global Transforms

gkanapathy — Fri, 18 Feb 2011 05:21:33 GMT

I don't believe this is the case. All matching stanza rules in props.conf are applied to events.

Re: Global Transforms

samcogheil — Thu, 30 Apr 2015 08:38:13 GMT

Just to note: Since 5.0 - you can now use the [default] stanza.