how to apply the props and tranforms ?

[_Raj]

Hi all,

How to apply props.conf and transforms.conf
Sample Log Data
2024-09-01 12:10:22 student=Alice subject=Math score=85
2024-09-01 12:11:45 student=Bob subject=Science score=72
Objective
 Extract fields properly.
 Apply a transform to mask student names.

thanks

[gcusello]

Hi @_Raj ,

when you have fieldname=fieldvalue you don't need to extract fields because fields are automatically extracted by Splunk.

To mask field values, do you want to do this at index time or at search time?

if at index time, data are modified and indexed modified, so you lose the original values, you can do this in the props.conf using SEDCMD command:

SEDCMD_Anonymize = s/student\=(\w+)\s/student\=(*****)\s/g

For more infos see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Data/Anonymizedata

If at search time, data aren't modified and masked only in the dashboard, but accessing data using a search they are visible.

You can do this in many ways, e.g. eval or rex command (using the same regex of the other solution):

| rex mode=sed "s/student\=(\w+)\s/student\=(*****)\s/g"

Ciao.

Giuseppe

[richgalloway]

What settings have you tried so far and what results did you get?

Props and transforms must be applied on the first full Splunk instance that touches the data.  In most cases that is an indexer, but it could be an intermediate heavy forwarder.

If you want to extract fields at search time (preferred) see https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/evaluate-and-manipulate-field...

To extract fields at index time (not recommended) see https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/10.0/confi...

See https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/10.0/confi... for how to mask data using props and transforms.