Is it possible to use field transformation at search level?

[andakun_222]

I want to create a report with search query, Is there any way to use field transformation in it?

For example:

      <query>eventtype="AWB"  | fieldtransformation = fieldtransformationname.</query>
    </search>

Thanks.

[somesoni2 · Accepted solution]

You can specify the transforms.conf stanza (only search time field extraction specific) name as parameter <extractor-name> in the extract command. See this for more information.

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Extract

[andakun_222]

thanks somesoni, created field transformation from UI and accessed it through extract command at search level. Working as expected.