Getting Data In



This question may seem pretty silly but I'm really clueless about SPLUNK.

I do know where to configure the props.conf,however,I'm not too sure how do I configure the transform.conf for my logs. How do I go about doing it?

Do I put the transform.conf into the field where I input my props.conf as well? (At the start when I'm importing my data into SPLUNK)

Please help me!

Tags (1)
0 Karma

Path Finder

Hi JeffTanYH

If your props.conf is looking sometyhing like


"some props.conf entries e.g KV_MODE,SEDCMD"

REPORT-report = unclean

then it will reference the stanza "unclean" in transforms.conf

your transforms.conf would look like



DELIMS = "(""|", "="

Hope that clears things up for you


0 Karma

Splunk Employee
Splunk Employee

Not sure exactly what you are asking. Transforms.conf would be located in the same folder as props.conf. I would suggest looking at some other answers on here to find one that matches what you are trying to accomplish.

You are probably looking to do one of the following:

Customize field extraction at index-time
Route and filter data
Specification and example files for transforms.conf
Create and maintain search-time field extractions through configuration files

Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...