https://community.splunk.com/t5/Getting-Data-In/filter-indexing-with-transform/m-p/145144#M29633 <P>Sorry, you can't do this calculation in Splunk <STRONG>prior</STRONG> to indexing. If you want to do complexing processing of an input before indexing, you may need to consider writing your own pre-processing code. You might be able to make your code part of a Splunk scripted input, or you could architect it as a stand-alone process.</P> Wed, 16 Jul 2014 19:04:01 GMT lguinn2 2014-07-16T19:04:01Z https://community.splunk.com/t5/Getting-Data-In/filter-indexing-with-transform/m-p/145143#M29632 <P>Hi, I want to only index result of this before the log flow enter the index. I want it to calculate this and then enter it to index of the splunk as daily result of this query below. <BR /> Anyway to do this write as transform and props regexp or etc?</P> <PRE><CODE>ident="www.x.com" earliest=-1d@d |stats count(eval(match(useragent, "Googlebot/2.1"))) as "Googlebot/2.1",count(eval(match(useragent, "Googlebot-News"))) as "Googlebot-News",count(eval(match(useragent, "Googlebot-Image/1.0"))) as "Googlebot-Image/1.0" ,count(eval(match(useragent, "Googlebot-Video/1.0"))) as "Googlebot-Video/1.0",count(eval(match(useragent, "Googlebot-Mobile/2.1"))) as "Googlebot-Mobile/2.1",count(eval(match(useragent, "Google Web Preview"))) as "Google Web Preview", count(eval(match(useragent, "Feedfetcher-Google"))) as "Feedfetcher-Google"| eval "Google_TOTAL"='Googlebot/2.1'+'Googlebot-News'+'Googlebot-Image/1.0'+'Googlebot-Video/1.0'+'Googlebot-Mobile/2.1'+'Google Web Preview'+'Feedfetcher-Google' </CODE></PRE> Wed, 16 Jul 2014 14:01:28 GMT https://community.splunk.com/t5/Getting-Data-In/filter-indexing-with-transform/m-p/145143#M29632 levent_kurt 2014-07-16T14:01:28Z https://community.splunk.com/t5/Getting-Data-In/filter-indexing-with-transform/m-p/145144#M29633 <P>Sorry, you can't do this calculation in Splunk <STRONG>prior</STRONG> to indexing. If you want to do complexing processing of an input before indexing, you may need to consider writing your own pre-processing code. You might be able to make your code part of a Splunk scripted input, or you could architect it as a stand-alone process.</P> Wed, 16 Jul 2014 19:04:01 GMT https://community.splunk.com/t5/Getting-Data-In/filter-indexing-with-transform/m-p/145144#M29633 lguinn2 2014-07-16T19:04:01Z