Splunk Search

Test props and transforms from Splunk UI

VatsalJagani
SplunkTrust
SplunkTrust

In Splunk when we add data via uploading file it gives UI to add and verify props.conf properties there, like timestamp extraction. This functionality is very useful while developing Add-on. (see below image)
alt text

I'm looking for functionality (may be via some other App) that can also give functionality to verify transforms.conf parameters also. Optionally if possible for tags.conf, eventtypes.conf parameters.

This functionality is very useful for a Splunk App developer as sometimes we don't have access to back-end.

0 Karma

adonio
Ultra Champion

look for this beta program:
https://www.splunk.com/en_us/software/splunk-next/splunk-data-stream-processor.html

also, there is a product that does what you are looking for ...
will not advertise it here, but if you will look carefully, you can use your favorite search engine to find it

hope it helps

FrankVl
Ultra Champion

I'm not aware of such features, but perhaps there is some app for that.

Typically you'd do this by onboarding (sample) data to a non-PROD Splunk instance first, where you would have full control as a developer.

kmorris_splunk
Splunk Employee
Splunk Employee

FrankVI's suggestion would be the way to go. If you work at a Splunk customer, you are able to request a 6-month, personalized dev/test license (50GB). It has limitations (single server, one user, etc...), but is great for testing props, transforms, etc... before you start playing around with your production environment.

https://www.splunk.com/blog/2016/11/02/devtest-licenses.html

At the end of the 6 months, you can request another license. When making the request, make sure you use a splunk.com user that is attached to your company email.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

The issue is not related to licence, I even don't want to index the events. I just want to write props and transforms for sample events.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Yeah, Agree with you but still if this feature is there direct on the UI then I would be able to write all configuration at comparatively flash speed.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...