https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257480#M49434 <P>Hi ankithreddy777,<BR /> see <A href="https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Transformsconf">https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Transformsconf</A></P> <BLOCKQUOTE> <P>DEST_KEY specifies where Splunk stores the expanded FORMAT results in accordance with the REGEX match.</P> </BLOCKQUOTE> <P>Bye.<BR /> Giuseppe</P> Mon, 23 Jan 2017 15:08:44 GMT gcusello 2017-01-23T15:08:44Z https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257479#M49433 <P>I am little bit confused by the explanation given for DEST_KEY IN TRANSFORMS.CONF. May I know what is the exact function of it. </P> Mon, 23 Jan 2017 15:01:42 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257479#M49433 ankithreddy777 2017-01-23T15:01:42Z https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257480#M49434 <P>Hi ankithreddy777,<BR /> see <A href="https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Transformsconf">https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Transformsconf</A></P> <BLOCKQUOTE> <P>DEST_KEY specifies where Splunk stores the expanded FORMAT results in accordance with the REGEX match.</P> </BLOCKQUOTE> <P>Bye.<BR /> Giuseppe</P> Mon, 23 Jan 2017 15:08:44 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257480#M49434 gcusello 2017-01-23T15:08:44Z https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257481#M49435 <P>There are two options: Field extractions at indexing time or at search time (e.g. CIM compliance).<BR /> You can define extractions using RegEx in the transforms.conf at indexing time (e.g. using a heavy forwarder). To do so, you can specify the DEST_KEY after a RegEx to determine where to store your data.</P> <P>Skalli</P> <P>Edit: Ah, too slow. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 23 Jan 2017 15:13:01 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257481#M49435 skalliger 2017-01-23T15:13:01Z https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257482#M49436 <P>@ankithreddy777 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.</P> Mon, 23 Jan 2017 19:56:09 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257482#M49436 aaraneta_splunk 2017-01-23T19:56:09Z https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257483#M49437 <P>You should pick the best answer and click <CODE>Accept</CODE>.</P> Tue, 24 Jan 2017 19:36:04 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-function-of-DEST-KEY-in-transforms-conf/m-p/257483#M49437 woodcock 2017-01-24T19:36:04Z