SPLK-1003 · Domain 17 of 17

SPLK-1003 Domain 17: Manipulating Raw Data

The final blueprint topic covers changing data before it is indexed: defining index-time transforms in props.conf and transforms.conf to mask values, override sourcetype or host, route events to indexes and drop unwanted events, and using SEDCMD for simple edits.

Exam weight
5%
Official objectives
3
Estimated questions estimate
~3
Suggested study time estimate
4–6 hrs

About 9 min read Reviewed October 2026

Overview

Domain 17 has three official objectives: explain how data transformations are defined and invoked; use transformations with props.conf and transforms.conf to mask or delete raw data as it is indexed, override sourcetype or host based on event values, route events to specific indexes based on content and prevent unwanted events from being indexed; and use SEDCMD to modify raw data. A transform is a transforms.conf stanza with REGEX, FORMAT and DEST_KEY, invoked from a props.conf stanza by a TRANSFORMS-<class> attribute.

These changes run in the parsing phase on indexers or heavy forwarders and affect only new data. At 5%, expect about three questions, usually showing a props and transforms pair and asking what it does, or asking for the DEST_KEY and FORMAT values that achieve a goal.

How it's tested

Questions show a props.conf stanza and its transforms.conf partner and ask what will happen to matching events, or describe a goal like dropping debug events and ask for the correct DEST_KEY and FORMAT. SEDCMD questions present a sed expression and ask how events will look after indexing.

  • Read the transform

    Given props.conf and transforms.conf snippets, you predict whether events are masked, rerouted, relabelled or dropped.

  • Build the transform

    A goal is described and you choose the REGEX, DEST_KEY and FORMAT values that achieve it.

  • Apply SEDCMD

    A masking requirement is given and you choose or interpret a SEDCMD substitution.

Reasoning it through

Only events containing ERROR should be indexed from a noisy sourcetype. The candidate defines two transforms: setnull with REGEX = . sending everything to nullQueue, then setparsing with REGEX = ERROR and FORMAT = indexQueue. In props.conf, TRANSFORMS-filter = setnull, setparsing applies them in that order, so the second rescues matching events. Reversing the order would drop everything.

Objectives 3

Official objectives from the Splunk outline, in outline order.

17.1 Explain how data transformations are defined and invokedtransforms.conf stanzas invoked by TRANSFORMS- in props.conf.
What it means
A data transformation is defined as a named stanza in transforms.conf with a REGEX to match, an optional SOURCE_KEY saying what to match against (default _raw), a DEST_KEY saying what to change and a FORMAT giving the new value. It is invoked from props.conf under a sourcetype, source:: or host:: stanza with TRANSFORMS-<class> = <stanza1>, <stanza2>.
What to understand
TRANSFORMS- invokes index-time transforms in the parsing phase; REPORT- invokes search-time field extractions. Several transforms in one TRANSFORMS- list run left to right. Index-time transforms must be on the parsing tier, and they affect only data indexed after a restart.
How it shows up
You explain how a transform is linked to data or which attribute invokes it at index time.
Common confusion
Using REPORT- to invoke an index-time transform such as routing or masking.
17.2 Use transformations with props.conf and transforms.conf to: mask or delete raw data as it is being indexed; override sourcetype or host based upon event values; route events to specific indexes based on event content; prevent unwanted events from being indexedMasking, metadata overrides, routing and filtering with transforms.
What it means
Each goal uses a specific DEST_KEY. Masking rewrites _raw with FORMAT built from capture groups, such as $1XXXX$2. Overriding sourcetype uses DEST_KEY = MetaData:Sourcetype and FORMAT = sourcetype::<name>; overriding host uses MetaData:Host and FORMAT = host::<name>. Routing uses DEST_KEY = _MetaData:Index with FORMAT = <index>. Dropping uses DEST_KEY = queue and FORMAT = nullQueue.
What to understand
Events sent to nullQueue are discarded and do not count against the license. To keep only certain events, send all to nullQueue first and then return matches to indexQueue in a later transform. Routing targets must exist on every indexer. Heavy forwarders can apply these transforms before data reaches indexers.
How it shows up
A goal is described and you choose the DEST_KEY and FORMAT values, or you predict the result of a configuration.
Common confusion
Ordering the keep-only-matches transforms with indexQueue first, so everything is dropped afterwards.
17.3 Use SEDCMD to modify raw datased-style substitutions in props.conf.
What it means
SEDCMD-<class> in props.conf applies a sed-style expression to _raw at index time. s/regex/replacement/g replaces matches, for example SEDCMD-mask = s/\d{12}(\d{4})/XXXXXXXXXXXX\1/g, and y/abc/xyz/ substitutes characters. No transforms.conf stanza is needed.
What to understand
SEDCMD is simpler than a transform for straightforward masking but cannot route, change metadata or drop events. Like transforms, it runs on the parsing tier and affects only newly indexed data. Several SEDCMD attributes with different class names can apply to one sourcetype.
How it shows up
A masking requirement is given and you choose or interpret a SEDCMD expression.
Common confusion
Expecting SEDCMD to drop events or change sourcetype, host or index.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • TRANSFORMS-<class>

    props.conf attribute that invokes index-time transforms.

    Remember
    Runs listed transforms left to right.
    Tested as
    Invocation questions.
    Trap
    Using REPORT- instead.

  • REGEX, FORMAT, DEST_KEY

    Core transforms.conf attributes.

    Remember
    SOURCE_KEY defaults to _raw.
    Tested as
    Transform design questions.
    Trap
    Omitting DEST_KEY.

  • DEST_KEY = _raw

    Rewrites event text for masking.

    Remember
    FORMAT uses capture groups like $1.
    Tested as
    Masking questions.
    Trap
    Losing unmatched text.

  • MetaData:Sourcetype

    DEST_KEY for sourcetype override.

    Remember
    FORMAT = sourcetype::<name>.
    Tested as
    Override questions.
    Trap
    Forgetting the sourcetype:: prefix.

  • MetaData:Host

    DEST_KEY for host override.

    Remember
    FORMAT = host::<name>.
    Tested as
    Override questions.
    Trap
    Forgetting the host:: prefix.

  • _MetaData:Index

    DEST_KEY for routing to an index.

    Remember
    FORMAT is the index name.
    Tested as
    Routing questions.
    Trap
    Routing to a missing index.

  • nullQueue

    Queue that discards events.

    Remember
    DEST_KEY = queue, FORMAT = nullQueue.
    Tested as
    Filtering questions.
    Trap
    Expecting license to be charged.

  • indexQueue

    Returns events to normal indexing.

    Remember
    Used after a catch-all nullQueue transform.
    Tested as
    Keep-only questions.
    Trap
    Ordering it first.

  • SEDCMD

    sed-style edits to _raw in props.conf.

    Remember
    s/// to replace, y/// to substitute characters.
    Tested as
    Masking questions.
    Trap
    Expecting it to route or drop.

  • Parsing tier placement

    Transforms and SEDCMD run on indexers or heavy forwarders.

    Remember
    No effect on universal forwarders.
    Tested as
    Placement questions.
    Trap
    Configuring them on a UF.

  • Index-time permanence

    Changes apply only to newly indexed data.

    Remember
    Indexed data cannot be unmasked.
    Tested as
    Change impact questions.
    Trap
    Expecting old events to change.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Transform goals and DEST_KEY values

ConceptMeaningKey differenceCommon trap
Mask data Rewrite event text DEST_KEY = _raw Losing context outside the match
Override sourcetype or host Change metadata MetaData:Sourcetype or MetaData:Host Missing the :: prefix
Route to index Send to another index DEST_KEY = _MetaData:Index Index not created
Drop events Discard before indexing DEST_KEY = queue, FORMAT = nullQueue Wrong transform order

Transforms versus SEDCMD

ConceptMeaningKey differenceCommon trap
TRANSFORMS with transforms.conf Flexible index-time changes Mask, route, override, drop Using REPORT- to invoke
SEDCMD Inline sed substitution Edits _raw only Expecting routing or dropping

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. REPORT for routing

    What candidates pick
    Invoke a routing transform with REPORT-.
    Why it looks right
    REPORT also references transforms.conf.
    Why it's wrong
    REPORT- runs search-time extractions; index-time changes need TRANSFORMS-.

    Clue to watch for The goal changes data before indexing.

  2. Wrong order

    What candidates pick
    List setparsing before setnull.
    Why it looks right
    Keeping matches feels like the first step.
    Why it's wrong
    Transforms run left to right, so a later catch-all nullQueue would drop the kept events.

    Clue to watch for The goal is keeping only some events.

  3. UF applies transforms

    What candidates pick
    Configure masking transforms on universal forwarders.
    Why it looks right
    Masking at the source sounds safer.
    Why it's wrong
    Universal forwarders do not parse, so transforms there have no effect.

    Clue to watch for Data passes from a UF straight to indexers.

  4. No prefix

    What candidates pick
    Set FORMAT = web_access for a sourcetype override.
    Why it looks right
    Routing uses a bare index name.
    Why it's wrong
    Sourcetype overrides need FORMAT = sourcetype::web_access with DEST_KEY = MetaData:Sourcetype.

    Clue to watch for The DEST_KEY is MetaData:Sourcetype.

  5. SEDCMD drops events

    What candidates pick
    Use SEDCMD to remove debug events.
    Why it looks right
    It edits raw data.
    Why it's wrong
    SEDCMD only modifies text in events; dropping requires a nullQueue transform.

    Clue to watch for Whole events must be discarded.

  6. Fix old data

    What candidates pick
    Expect a new mask to hide values already indexed.
    Why it looks right
    The configuration now matches them.
    Why it's wrong
    Index-time changes affect only new data; existing events stay as they were.

    Clue to watch for Sensitive data is already stored.

Answer framework

Use these steps to design or interpret an index-time data change.

  1. State the goal precisely: mask part of an event, change sourcetype or host, route to another index, drop events, or make a simple text substitution.
  2. For simple text replacement choose SEDCMD in props.conf; for metadata changes, routing or dropping, define a transforms.conf stanza.
  3. Set REGEX and the matching DEST_KEY and FORMAT pair, including sourcetype:: or host:: prefixes and nullQueue or index names as needed.
  4. Invoke the transforms with TRANSFORMS-<class> in the right props.conf stanza, ordering them left to right when one must override another.
  5. Deploy to the parsing tier, create any target indexes, restart, and verify on new events, since existing data is not changed.

Practice question

An admin must stop DEBUG events from a sourcetype being indexed while keeping all other events. Which transforms.conf stanza, invoked by TRANSFORMS-drop in props.conf on the indexers, achieves this?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Make a reference card with one row per goal: mask, override sourcetype, override host, route, drop and keep only matches. For each row, write the DEST_KEY and FORMAT values exactly, plus any prefix. Learn the card until you can fill it in from memory, because most questions in this topic test those exact pairings.

In a lab, index a small sample file containing fake card numbers, debug lines and mixed hostnames. Write one transform at a time, restart, and index fresh copies of the file to see each effect. Build the keep-only-matches pair and then swap the order to watch every event disappear. Repeat the masking task with SEDCMD to compare the two approaches.

Afterwards, list which instance in a universal forwarder, heavy forwarder and indexer architecture should hold these settings, linking back to the parsing phase topic. Finish with questions that show configuration snippets, since reading unfamiliar props and transforms pairs quickly is the main exam skill here.

FAQ

How much of SPLK-1003 is Manipulating Raw Data?

Manipulating Raw Data is 5% of the exam, about three questions, covering transforms, the props and transforms pairing, and SEDCMD.

What is the difference between TRANSFORMS- and REPORT-?

TRANSFORMS- runs index-time transforms during parsing. REPORT- runs search-time field extractions defined in transforms.conf.

How do I drop unwanted events?

Create a transform with a REGEX matching them, DEST_KEY = queue and FORMAT = nullQueue, and invoke it with TRANSFORMS- in props.conf.

Do dropped events count against the license?

No. Events sent to the nullQueue are discarded before indexing, so they do not count toward daily license usage.

When should I use SEDCMD instead of a transform?

For straightforward text substitution such as masking. Use transforms for routing, metadata changes or dropping events.

Where must transforms be configured?

On the parsing tier: the heavy forwarder if one is in the data path, otherwise the indexers.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 17 knowledge

You have covered defining and invoking transforms, masking, routing, overrides, filtering and SEDCMD. Test whether you can read and build index-time configurations accurately.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going