I want to mask some information in the data I have in my pc. So, i wanted to edit transforms.conf, and upload the data through conf files so that data masking can take place at the indexing time.
hello there, for one time upload,
run the command
splunk add oneshot
see full description here:
if the data is smaller than 500MB, you can drag and drop in the "add data" page
hope it helps
you can create the props and transforms on your indexer and when using oneshot, specify the sourcetype.
that will apply your rules of masking to your data
you can not do one shot through conf files. you can setup the monitor stanza one time and than disable / comment it out