filter indexing with transform

[levent_kurt]

Hi, I want to only index result of this before the log flow enter the index. I want it to calculate this and then enter it to index of the splunk as daily result of this query below.
Anyway to do this write as transform and props regexp or etc?

ident="www.x.com" earliest=-1d@d  |stats count(eval(match(useragent, "Googlebot/2.1"))) as "Googlebot/2.1",count(eval(match(useragent, "Googlebot-News"))) as "Googlebot-News",count(eval(match(useragent, "Googlebot-Image/1.0"))) as "Googlebot-Image/1.0" ,count(eval(match(useragent, "Googlebot-Video/1.0"))) as "Googlebot-Video/1.0",count(eval(match(useragent, "Googlebot-Mobile/2.1"))) as "Googlebot-Mobile/2.1",count(eval(match(useragent, "Google Web Preview"))) as "Google Web Preview", count(eval(match(useragent, "Feedfetcher-Google"))) as "Feedfetcher-Google"| eval "Google_TOTAL"='Googlebot/2.1'+'Googlebot-News'+'Googlebot-Image/1.0'+'Googlebot-Video/1.0'+'Googlebot-Mobile/2.1'+'Google Web Preview'+'Feedfetcher-Google'

[lguinn2 · Accepted solution]

Sorry, you can't do this calculation in Splunk prior to indexing. If you want to do complexing processing of an input before indexing, you may need to consider writing your own pre-processing code. You might be able to make your code part of a Splunk scripted input, or you could architect it as a stand-alone process.