topic Re: Using transforms.conf to create a new field in Splunk Search

Using transforms.conf to create a new field

mw — Sat, 08 Jan 2011 13:25:03 GMT

I have events which include:

.... relevant=False ....

and I'd like to transform those at search time into a field that doesn't yet exist:

.... compliant=True ....

I thought that this transforms entry, along with the associated props REPORT would do it, but I'm missing something:

# Flip the relevant result to a compliant field
[rtc_comp]
SOURCE_KEY = relevant
DEST_KEY = compliant
REGEX = False
FORMAT = True

Thanks in advance!

Re: Using transforms.conf to create a new field

Stephen_Sorkin — Sun, 09 Jan 2011 11:43:30 GMT

The problem here is probably that regex-based field extractions take place before automatic field=value extractions. Your best bet here isn't to use field extractions to map relevant to compliant, but rather to use a csv lookup table to create the new field. It will be higher performance especially if you want to refer to "compliant" in the search itself.

A good introduction is at: http://blogs.splunk.com/2009/07/27/enriching-data-with-lookups-part-1/ or http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources

Re: Using transforms.conf to create a new field

mw — Mon, 10 Jan 2011 07:48:18 GMT

Thank you, sir! That was my next destination. Incidentally, is there data regarding the performance of various actions, or some sort of performance priority chart?