What are Props and Transforms in Splunk?

Splunk is a powerful tool for analyzing and visualizing machine-generated data. It uses various configurations to process and enrich data. Among these configurations, “props” and “transforms” play crucial roles. Understanding their functionalities and deployment locations within a Splunk environment is key to optimizing data management and search capabilities.

Props.conf

“Props” in Splunk are configurations defined in the “props.conf” file. This file contains settings that control how Splunk parses and displays incoming data. Key functionalities of “props.conf” include:

Data Parsing: It defines how to break the incoming data into individual events.
Timestamp Extraction: Configuring the correct timestamp for events.
Data Enrichment: Setting event types and adding metadata like source type.
Field Extraction: Identifying and extracting fields at index-time or search-time.

Transforms.conf

“Transforms” are defined in the “transforms.conf” file. This file is primarily used for:

Field Transformations: Creating new fields from existing data, often using regular expressions.
Data Anonymization: Masking or obfuscating sensitive information in the data.
Lookup Definitions: Linking external data sources for enrichment.
Routing and Filtering: Directing data to specific indexes or dropping unwanted data.

The usage and deployment of “props” and “transforms” depend on whether the data is being processed at index-time or search-time.

Index-Time Configurations

On Indexers: At index-time, both “props.conf” and “transforms.conf” are primarily used on indexers. They parse and prepare data as it’s being indexed.
On Heavy Forwarders: For certain preprocessing needs, these configurations can also be used on heavy forwarders, which can parse and filter data before it’s sent to indexers.