I have an XML based source that has special characters defined. See below
& &
< <
> >
" "
' '
Does anyone know how to use transforms.conf to convert these to the real characters in the left column at index time?
Add this in your sourcetype definition (props.conf)
[yoursourcetype]
...
..other configs..
...
SEDCMD-specialchars1 = s/specialcodeInxml/replacementcode/g
You need to add one entry for each special character replacement.
e.g.
for &
SEDCMD-specialchars5 = s/&/\&/g
for others
SEDCMD-specialchars3 = s/"/"/g
SEDCMD-specialchars4 = s/'/'/g
For more details see this documentation-
http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Anonymizedatausingconfigurationfiles
search for "Anonymize data through a sed script"