Configurations Required for Data Normalization in Splunk

Data normalization ensures consistent field naming and event structuring, especially for Splunk Common Information Model (CIM) compliance.

✅1. props.conf (A)

Defines how data is parsed and indexed.

Controls field extractions, event breaking, and timestamp recognition.

Example:

Assigns custom sourcetypes and defines regex-based field extraction.

✅2. transforms.conf (B)

Used for data transformation, lookup table mapping, and field aliasing.

Example:

Normalizes firewall logs by renaming src_ip → src to align with CIM.

❌Incorrect Answers:

C. savedsearches.conf → Defines scheduled searches, not data normalization.

D. authorize.conf → Manages user permissions, not data normalization.

E. eventtypes.conf → Groups events into categories but doesn’t modify data structure.

????Additional Resources:

Splunk Data Normalization Guide

Understanding props.conf and transforms.conf