Is there a way to insert literal values into events before they are indexed?

[erinboudreau]

Is there a way to insert values into events before they are indexed? We need to be able to insert string literals into our events before they are indexed.

[sloshburch]

If not happy with the answer, give us a scenario and details on how the inserts are valuable. There might be other ways to skin the cat than inserting literals.

[richgalloway]

Take a look at the REGEX and FORMAT attributes in the transforms.conf file. See http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf.