Splunk Search

understanding the transforms.conf

kteng2024
Path Finder

hi,
Can someone please explain me the below transforms.conf . I read the documentation ,but it's not clear to me .

[route-index-abc]
REGEX = (.*) ( what is the use of REGEX)
DEST_KEY = _MetaData:Index ( what is the use DEST_KEY)
FORMAT = server_application ( what is the use of FORMAT)

0 Karma

somesoni2
Revered Legend

The transforms.conf entry that you've is applied to each event of a sourcetype, source or host.

  • The REGEX is a regular expression that tries to find a match from the value of SOURCE_KEY (an attribute which has default value as _raw, your raw data). A dot means it'll match everything (the transform will be done for all events).
  • DEST_KEY - it provides a Splunk field (that are available at the time of parsing) where the transformation will be applied.
  • FORMAT - it's a value that will be applied to value of DEST_KEY

So basically what it's doing here is, for each event, change the value of index (represented as _MetaData:Index in transforms.conf) with value server_application, regardless of what it's original value was.

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...