topic Re: how to apply the props and tranforms ? in Getting Data In

how to apply the props and tranforms ?

_Raj — Wed, 15 Oct 2025 16:05:15 GMT

Hi all,

How to apply props.conf and transforms.conf
Sample Log Data
2024-09-01 12:10:22 student=Alice subject=Math score=85
2024-09-01 12:11:45 student=Bob subject=Science score=72
Objective
 Extract fields properly.
 Apply a transform to mask student names.

thanks

Re: how to apply the props and tranforms ?

richgalloway — Wed, 15 Oct 2025 16:47:35 GMT

What settings have you tried so far and what results did you get?

Props and transforms must be applied on the first full Splunk instance that touches the data. In most cases that is an indexer, but it could be an intermediate heavy forwarder.

If you want to extract fields at search time (preferred) see https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/evaluate-and-manipulate-fields/extract-fields-with-search-commands

To extract fields at index time (not recommended) see https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/10.0/configure-indexed-field-extraction/about-indexed-field-extraction#d96b9241afbd44e29ba4333824cea50e5__About_indexed_field_extraction

See https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/10.0/configure-event-processing/anonymize-data for how to mask data using props and transforms.

Re: how to apply the props and tranforms ?

gcusello — Thu, 16 Oct 2025 06:39:01 GMT

Hi @_Raj ,

when you have fieldname=fieldvalue you don't need to extract fields because fields are automatically extracted by Splunk.

To mask field values, do you want to do this at index time or at search time?

if at index time, data are modified and indexed modified, so you lose the original values, you can do this in the props.conf using SEDCMD command:

SEDCMD_Anonymize = s/student\=(\w+)\s/student\=(*****)\s/g

For more infos see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Data/Anonymizedata

If at search time, data aren't modified and masked only in the dashboard, but accessing data using a search they are visible.

You can do this in many ways, e.g. eval or rex command (using the same regex of the other solution):

| rex mode=sed "s/student\=(\w+)\s/student\=(*****)\s/g"

Ciao.

Giuseppe