When should I use Report and when should I use Transform on the props.conf?
As per documentation, TRANSFORM is used for creating index time field (a field identified during indexing of data and is saved to index, indexing overhead) and REPORT or EXTRACT is used to create search time field extractions ( fields not saved to index rather extracted at search time).
For more details see props.conf specification from link below (search for section "# Field extraction configuration" on the page)
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Propsconf
As per documentation, TRANSFORM is used for creating index time field (a field identified during indexing of data and is saved to index, indexing overhead) and REPORT or EXTRACT is used to create search time field extractions ( fields not saved to index rather extracted at search time).
For more details see props.conf specification from link below (search for section "# Field extraction configuration" on the page)
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Propsconf
Based on your requirement (data deletion instead of data masking), you should use SEDCMD in props.conf instead of REPORT or TRANSFORM. I have provided an answer in your related question. Have a look at that.
Thanks,
In my case I want to remove this "ORG PRINTER SELECT = Deny, PRIV FILE AOC = Deny, ATTORNEY PORTAL = Deny,..." from my logs, would you be able to tell if that construction for the transform and props have any flaw?
Transforms.conf
[removedeny]
REGEX = ^([A-Za-z0-9\S\s]+\s=\sDeny,)$
FORMAT = $1$2
DEST_KEY = _raw
Props.conf
REPORT-removedeny = removedeny or
Transform-removedeny = removedeny
Thank you for your help!