https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-to-insert-literal-values-into-events-before-they/m-p/204329#M40331 <P>If not happy with the answer, give us a scenario and details on how the inserts are valuable. There might be other ways to skin the cat than inserting literals.</P> Thu, 04 Aug 2016 14:07:51 GMT sloshburch 2016-08-04T14:07:51Z https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-to-insert-literal-values-into-events-before-they/m-p/204327#M40329 <P>Is there a way to insert values into events before they are indexed? We need to be able to insert string literals into our events before they are indexed. </P> Wed, 03 Aug 2016 17:35:51 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-to-insert-literal-values-into-events-before-they/m-p/204327#M40329 erinboudreau 2016-08-03T17:35:51Z https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-to-insert-literal-values-into-events-before-they/m-p/204328#M40330 <P>Take a look at the REGEX and FORMAT attributes in the transforms.conf file. See <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf">http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf</A>.</P> Wed, 03 Aug 2016 17:53:31 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-to-insert-literal-values-into-events-before-they/m-p/204328#M40330 richgalloway 2016-08-03T17:53:31Z https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-to-insert-literal-values-into-events-before-they/m-p/204329#M40331 <P>If not happy with the answer, give us a scenario and details on how the inserts are valuable. There might be other ways to skin the cat than inserting literals.</P> Thu, 04 Aug 2016 14:07:51 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-to-insert-literal-values-into-events-before-they/m-p/204329#M40331 sloshburch 2016-08-04T14:07:51Z