https://community.splunk.com/t5/Getting-Data-In/How-can-I-force-a-transforms-conf-to-also-run-on-data-onboarded/m-p/619157#M106770 <P>I'm trying to make a test with data that I onboarded with the <A href="https://community.splunk.com/t5/Getting-Data-In/Is-there-an-easy-way-to-create-fake-data/m-p/618259#M106691" target="_self">collect</A> command.</P> <P>What I see is that when I insert an event that is exactly the same as existing events, the data that I insert is not able to be searched on the fields while it is possible with the data that is normally onboarded.</P> <P>My guess is that the transforms.conf configuration is not running on collect events, but I can not figure out how i can make sure it happens.</P> <P>&nbsp;</P> <P>How can I force a transforms.conf to also run on data onboarded with collect?</P> Wed, 02 Nov 2022 02:43:48 GMT sboogaar 2022-11-02T02:43:48Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-force-a-transforms-conf-to-also-run-on-data-onboarded/m-p/619157#M106770 <P>I'm trying to make a test with data that I onboarded with the <A href="https://community.splunk.com/t5/Getting-Data-In/Is-there-an-easy-way-to-create-fake-data/m-p/618259#M106691" target="_self">collect</A> command.</P> <P>What I see is that when I insert an event that is exactly the same as existing events, the data that I insert is not able to be searched on the fields while it is possible with the data that is normally onboarded.</P> <P>My guess is that the transforms.conf configuration is not running on collect events, but I can not figure out how i can make sure it happens.</P> <P>&nbsp;</P> <P>How can I force a transforms.conf to also run on data onboarded with collect?</P> Wed, 02 Nov 2022 02:43:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-force-a-transforms-conf-to-also-run-on-data-onboarded/m-p/619157#M106770 sboogaar 2022-11-02T02:43:48Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-force-a-transforms-conf-to-also-run-on-data-onboarded/m-p/619210#M106777 <P>Are you using the _raw field to collect your events or are you setting fields?</P><P>Is your transforms based on sourcetype and are you setting sourcetype for the collect.</P><P>Note that the collect docs are not good and contain a number of errors.</P><P>You cannot pass a _time field - if you want _time, you have to put the time into a _raw field and let it be parsed there.</P><P>&nbsp;</P> Tue, 01 Nov 2022 22:12:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-force-a-transforms-conf-to-also-run-on-data-onboarded/m-p/619210#M106777 bowesmana 2022-11-01T22:12:50Z