Getting Data In



This question may seem pretty silly but I'm really clueless about SPLUNK.

I do know where to configure the props.conf,however,I'm not too sure how do I configure the transform.conf for my logs. How do I go about doing it?

Do I put the transform.conf into the field where I input my props.conf as well? (At the start when I'm importing my data into SPLUNK)

Please help me!

Tags (1)
0 Karma

Re: transforms.conf

Splunk Employee
Splunk Employee

Not sure exactly what you are asking. Transforms.conf would be located in the same folder as props.conf. I would suggest looking at some other answers on here to find one that matches what you are trying to accomplish.

You are probably looking to do one of the following:

Customize field extraction at index-time
Route and filter data
Specification and example files for transforms.conf
Create and maintain search-time field extractions through configuration files


Re: transforms.conf

Path Finder

Hi JeffTanYH

If your props.conf is looking sometyhing like


"some props.conf entries e.g KV_MODE,SEDCMD"

REPORT-report = unclean

then it will reference the stanza "unclean" in transforms.conf

your transforms.conf would look like



DELIMS = "(""|", "="

Hope that clears things up for you


0 Karma