topic Re: When should I use Report or Transform on props.conf? in Getting Data In

When should I use Report or Transform on props.conf?

celsohso — Wed, 30 Jul 2014 13:35:58 GMT

When should I use Report and when should I use Transform on the props.conf?

Re: When should I use Report or Transform on props.conf?

somesoni2 — Wed, 30 Jul 2014 14:14:36 GMT

As per documentation, TRANSFORM is used for creating index time field (a field identified during indexing of data and is saved to index, indexing overhead) and REPORT or EXTRACT is used to create search time field extractions ( fields not saved to index rather extracted at search time).

For more details see props.conf specification from link below (search for section "# Field extraction configuration" on the page)

http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Propsconf

Re: When should I use Report or Transform on props.conf?

celsohso — Wed, 30 Jul 2014 14:46:42 GMT

Thanks,
In my case I want to remove this "ORG PRINTER SELECT = Deny, PRIV FILE AOC = Deny, ATTORNEY PORTAL = Deny,..." from my logs, would you be able to tell if that construction for the transform and props have any flaw?

Transforms.conf
[removedeny]
REGEX = ^([A-Za-z0-9\S\s]+\s=\sDeny,)$
FORMAT = $1$2
DEST_KEY = _raw

Props.conf
REPORT-removedeny = removedeny or
Transform-removedeny = removedeny

Thank you for your help!

Re: When should I use Report or Transform on props.conf?

somesoni2 — Wed, 30 Jul 2014 18:22:44 GMT

Based on your requirement (data deletion instead of data masking), you should use SEDCMD in props.conf instead of REPORT or TRANSFORM. I have provided an answer in your related question. Have a look at that.

http://answers.splunk.com/answers/148270/transformconf-hide-values-or-make-them-anonymous?page=1&focusedAnswerId=148342#148342