Getting Data In

Is it possible to use field transformation at search level?

New Member

I want to create a report with search query, Is there any way to use field transformation in it?

For example:

      <query>eventtype="AWB"  | fieldtransformation = fieldtransformationname.</query>
    </search>

Thanks.

0 Karma
1 Solution

Revered Legend

You can specify the transforms.conf stanza (only search time field extraction specific) name as parameter <extractor-name> in the extract command. See this for more information.

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Extract

View solution in original post

0 Karma

Revered Legend

You can specify the transforms.conf stanza (only search time field extraction specific) name as parameter <extractor-name> in the extract command. See this for more information.

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Extract

View solution in original post

0 Karma

New Member

thanks somesoni, created field transformation from UI and accessed it through extract command at search level. Working as expected.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!