Getting Data In

Is it possible to use field transformation at search level?

New Member

I want to create a report with search query, Is there any way to use field transformation in it?

For example:

      <query>eventtype="AWB"  | fieldtransformation = fieldtransformationname.</query>
    </search>

Thanks.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can specify the transforms.conf stanza (only search time field extraction specific) name as parameter <extractor-name> in the extract command. See this for more information.

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Extract

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You can specify the transforms.conf stanza (only search time field extraction specific) name as parameter <extractor-name> in the extract command. See this for more information.

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Extract

View solution in original post

0 Karma

New Member

thanks somesoni, created field transformation from UI and accessed it through extract command at search level. Working as expected.

0 Karma