Attributes of the format REPORT-foo in props.conf call stanzas in transforms.conf at search time, which means that they cannot affect metadata fields. EXTRACT definitions are more convenient to write, as they live entirely in a single attribute in props.conf, but there are a couple of things that can only be done using a REPORT attribute paired with a transform defined in transforms.conf.
Using REPORT
Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
