Transforms not replacing original value

thard_splunk — Tue, 29 Sep 2020 14:20:27 GMT

Hello,

I have a CSV in which I am attempting to shorten a 128 character string down to the last 8 characters. I used the following configuration in transforms/props:

props.conf:

[taxi_csv]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
disabled = false
pulldown_type = true
description = Comma-separated value format. Set header and other settings in "D$
TIMESTAMP_FIELDS = Trip Start Timestamp
TZ = America/Chicago
TRANSFORM-mask = taxiMask

transforms.conf:

[taxiMask]
REGEX = (\w{120})(\w{8})
FORMAT = "Taxi ID"::$2
WRITE_META = true
SOURCE_KEY = field:"Taxi ID"
DEST_KEY = _raw

However, the resulting indexed data contains both the original string and the shortened string as two separate values in the same field. What configuration change can I make to replace the original value with the shortened string?

Thanks!

Re: Transforms not replacing original value

somesoni2 — Thu, 08 Jun 2017 15:11:50 GMT

Try this for your transforms.conf entry

[taxiMask]
REGEX = (?m)^(.*)(\w{120})(\w{8})(.*)$
FORMAT = $1$3$4
DEST_KEY = _raw

topic Re: Transforms not replacing original value in Getting Data In

Transforms not replacing original value

Re: Transforms not replacing original value