I want to create a report with search query, Is there any way to use field transformation in it?
For example:
<query>eventtype="AWB" | fieldtransformation = fieldtransformationname.</query>
</search>
Thanks.
You can specify the transforms.conf stanza (only search time field extraction specific) name as parameter <extractor-name>
in the extract
command. See this for more information.
http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Extract
You can specify the transforms.conf stanza (only search time field extraction specific) name as parameter <extractor-name>
in the extract
command. See this for more information.
http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Extract
thanks somesoni, created field transformation from UI and accessed it through extract command at search level. Working as expected.