Our Splunk server receives data via syslog. As a result, I need to transform the syslog data using transforms.conf and props.conf (Details in the question "Why does Splunk not recognize standard fields in my Apache data forwarded by syslog?". My question, can I transform the data and still do some field extraction on that data? I would like to preserve the process field. However, the default transform simply strips out the data. It doesn't save any of the fields. So, given the following transformation in local/props.conf : [syslog] TRANSFORMS-strip-syslog-header = syslog-header-stripper-ts-host-proc And this default transform from default/transforms.conf : # This will strip out date stamp, host, process with pid and just get the # actual message [syslog-header-stripper-ts-host-proc] REGEX = ^[A-Z][a-z]+\s+\d+\s\d+:\d+:\d+\s.*?:\s(.*)$ FORMAT = $1 DEST_KEY = _raw Can I somehow preserve one of the fields and save it to the name of process ? I have had some luck with the following pattern, saved at https://www.regex101.com/r/iK8iX5/1 . However, I am uncertain how to use this in a Splunk Transform. ^(?<SyslogPri><\d+>)(?<SyslogDate>[A-Z][a-z]+\s+\d+\s\d+:\d+:\d+)\s(?<SyslogHost>.*)\s(?<process>.*):\s(?<SyslogMessage>.*)$ ... View more