What is the main purpose of using transforms in Splunk Cloud?

The main purpose of using transforms in Splunk Cloud is to preprocess input data before indexing. Transforms allow you to manipulate or modify data as it is ingested by Splunk, enabling you to format, filter, or extract fields from the data effectively. For example, you might use transforms to perform tasks such as data masking, modifying event timestamps, or even routing data to different indexes based on specific criteria. This preprocessing step is critical as it ensures that the data is structured correctly and optimized for searching, reporting, and analysis after it has been indexed.

While visualizing data quickly, enhancing storage capabilities, and scheduling data input are important features within the Splunk ecosystem, they do not specifically relate to the core function of transforms, which is about modifying and preparing raw data before it is stored in the indexed format. Therefore, the focus of transforms is primarily on the preprocessing stage, ensuring that the data ingested into Splunk is in a usable state right from the moment it is indexed.