Splunk Add-on for Amazon Kinesis Firehose: When to use lambda transformations?

[myu_splunk]

When should I use transforms via Lambda with Kinesis Firehose when sending in application data through Kinesis?

[myu_splunk]

You need to use a lambda transform when 1) your data is in a format that is not supported by HEC (ex: VPC flow logs), or 2) if you want to use the /events HEC endpoint for doing things like index/source/sourcetype/timestamp overriding, or 3) if you want to transform your data in any custom way before getting indexed into your Splunk deployment.