---
title: Transform Data Action - Use Cases
slug: transform-data-action-use-cases
docTags: 
createdAt: 2025-08-11T11:13:49.000Z
---

The Turbine Transform Data native action can create a myriad of transformations. Making changes to date and time in a playbook is often used, and this page provides use cases for different actions for transforming date and time using the Transform Data action. [JSONata](https://docs.jsonata.org/date-time-functions) is used for these actions.

## Get Date and Time

If you configure the FIRST row, click **TRANSFORM AGAIN**, and select **Get Date/Time**, there are new configuration options available.

![Get Date/Time Configuration](https://app.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/bIsN4xNg5cEHj_o4EsG5v_transform-row-2-get-date-time.png)

### Transform Block Options - Get Date/Time

**Note:** When FROM is set to "Current Time", the IN field is not required and will be hidden.

### Scenario

After identifying malicious URLs, you want to scan your environment for any other IOCs that may have been seen 90 days before the first sighting. With the Transform Data action, you can automate this task to get a date/time and subtract 90 days.

1. On the **FIRST** row, select **Get Date/Time**.
2. From the **FROM** drop-down, select **Playbook Data** or **Current Time**.
3. If using Playbook Data, select the property containing the date/time in the **IN** field.
4. Configure the format and timezone as needed.
5. Click **TRANSFORM AGAIN**.
6. On the **THEN** row, select **Adjust Date/Time**.
7. From the **BY** drop-down menu, select **Subtracting**.
8. Enter **90** in the amount field.
9. From the unit of measure drop-down menu, select **Days**.

## Adjust Date and Time

Common date and time data transformation methods are supported in playbooks, which can be run against playbook inputs, in-scope action output properties, or static values, including to and from:

- ISO-8601
- Unix (seconds)
- Unix (milliseconds)
- SQL
- [Custom formatting](https://moment.github.io/luxon/#/parsing?id=table-of-tokens)
- [XPath Picture string format](https://www.w3.org/TR/xpath-functions-31/#date-picture-string)

::Image[]{src="https://app.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/qNjk27YTwLrcS9O8USxjJ_transform-adjust-date-time.png" size="80" width="1157" height="600" darkWidth="1157" darkHeight="600" position="center" alt="Adjust Date/Time Configuration" showCaption="false"}

### Transform Block Options - Adjust Date/Time

**Note:** Adjust Date/Time operates on ISO-8601 date/time values or Unix epochs. The result is always returned in ISO-8601 format.

### Scenario

After identifying malicious URLs, you want to scan your environment for any other IOCs that may have been seen 90 days before the first sighting. With the Transform Data action, you can automate this task to get a date/time and subtract 90 days.

1. On the **FIRST** row, select **Get Date/Time** to obtain the initial timestamp.
2. Click **TRANSFORM AGAIN**.
3. On the **THEN** row, select **Adjust Date/Time**.
4. From the **BY** drop-down menu, select **Subtracting**.
5. Enter **90** in the amount field.
6. From the unit of measure drop-down menu, select **Days**.

**Output:** The date/time adjusted by subtracting 90 days, returned in ISO-8601 format.

## Set Time Zone

After configuring the FIRST row, click **TRANSFORM AGAIN**, and select **Set Time Zone**. New fields and options are available on the THEN row.

![Set Date/Time Configuration](https://app.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/RGh6uVbqNB3FEPxF3TVXl_transform-set-date-time.png)

### Transform Block Options - Set Time Zone

**Note:** Set Time Zone adjusts the underlying date/time to reflect the new timezone. If you need to add timezone information without changing the actual time, use **Append Time Zone** instead.

### Scenario

After identifying malicious URLs, you want to scan your environment for any other IOCs that may be in a specific time zone.

1. On the **FIRST** row, select **Get Date/Time** to obtain the initial timestamp.
2. Click **TRANSFORM AGAIN**.
3. On the **THEN** row, select **Set Time Zone**.
4. From the **Time Zone** drop-down menu, select the desired time zone (e.g., America/Chicago, UTC, Europe/London).

**Output:** The date/time converted to the specified time zone in ISO-8601 format.

## Convert Date and Time

After configuring the FIRST row, click **TRANSFORM AGAIN**, and select **Convert Date/Time**. New fields and options are available on the THEN row.

![Convert Date/Time Configuration](https://app.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/wLlsN-dcsESPp1UlYUJz2_transform-convert-date-time.png)

### Transform Block Options - Convert Date/Time

**Note:** Convert Date/Time can convert between various date/time formats. The input date/time must be in ISO-8601 format or a Unix epoch.

### Scenario

After identifying malicious URLs, you want to scan your environment for any other IOCs that may have been seen starting on a particular month, date, and year before the first sighting.

1. On the **FIRST** row, select **Get Date/Time** to obtain the initial timestamp.
2. Click **TRANSFORM AGAIN**.
3. On the **THEN** row, select **Convert Date/Time**.
4. From the **TO** drop-down, select **Custom**.
5. In the **Custom Format String** field, enter the format pattern: `MM/dd/yyyy` (for MM/DD/YYYY format).

**Output:** The date/time converted to the custom format (e.g., "08/26/2025").

## Contains

The **Contains** transformation checks if a string contains at least one occurrence of a search term. The transformation options are:

### Scenario

After gathering information from different sources, you want to verify if a particular keyword (e.g., "malicious") is present in a text field.

1. On the **FIRST** drop-down, select **Contains**.
2. In the **IN** field, select the playbook property containing the text.
3. In the **STRING** field, enter the keyword (e.g., "malicious").
4. In the **WITH** drop-down, select **No Case Sensitivity** to perform a case-insensitive search.

![Contains Transformation Configuration](https://app.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/7WWkFolPhw5ndMiHCqYOH_transform-contains.png)

**Output:** Returns `true` if "malicious" is found in the text (regardless of case), `false` otherwise.

## Replace

The **Replace** transformation finds occurrences of a search term in a string and replaces each occurrence with another string. The transformation options are:

### Scenario

You need to normalize IP addresses in logs by replacing occurrences of "192.168" with "10.0".

1. On the **FIRST** drop-down, select **Replace**.
2. In the **IN** field, select the playbook property containing the text.
3. In the **FIND** field, enter "192.168".
4. In the **REPLACE WITH** field, enter "10.0".
5. In the **WITH** drop-down, select **No Case Sensitivity** to perform a case-insensitive replacement.

![Replace Transformation Configuration](https://app.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/-YWFtoUEhwoagp_1vNL19_transform-findreplace.png)

**Output:** All occurrences of "192.168" (case-insensitive) are replaced with "10.0" in the input string.

## Match

The **Match** transformation finds occurrences of a search term in a string and returns an array of all indices where the search term is located. The transformation options are:

### Scenario

To locate specific email addresses from text logs, match the pattern of an email address format.

1. On the **FIRST** row, select **Match**.
2. In the **IN** field, select the text field containing the logs.
3. In the **STRING** field, enter the search term or pattern. For exact string matching, enter the string directly (e.g., "@example.com").
4. In the **WITH** drop-down, select **No Case Sensitivity** to perform a case-insensitive search.

**Note:** For regex pattern matching to extract email addresses, use the **Regex Match** transformation instead, which supports regular expression patterns.

![Match Transformation Configuration](https://app.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/Y6XP0ii_OvdE5N1HfgWg1_transform-match.png)

**Output:** Returns an array of indices where the search term appears in the string (e.g., `[25, 67, 142]`).

## From CSV

The **From CSV** transformation parses a CSV string into an array of objects (if headers are included) or an array of arrays. The transformation options are:

### Scenario

You have a CSV string containing user information ("name, email, department") and want to parse it into separate fields.

1. On the **FIRST** drop-down, select **From CSV**.
2. In the **IN** field, choose the property containing the CSV data (or enter the CSV string directly).
3. In the **WITH HEADER** drop-down, select **Yes** if the first line contains column headers, or **No** if headers are not included.

![From CSV Transformation Configuration](https://app.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/RbekOmHApRcuqGltQ5yzB_transform-fromcsv.png)

**Example Input (with headers):**

**Output (with headers = Yes):**

**Output (with headers = No):**

## Additional Use Cases

### Parsing JSON Strings

When working with JSON data from record triggers, record searches, or HTTP responses, the data often arrives as a string. Use **Parse JSON** to convert it to a JavaScript object before extracting properties.

**Scenario:** Extract user information from a JSON string returned by an API.

1. On the **FIRST** row, select **Parse JSON**.
2. In the **IN** field, select the property containing the JSON string.
3. Click **TRANSFORM AGAIN**.
4. On the **THEN** row, select **Extract Property**.
5. Provide a JSONata path to extract the desired field (e.g., `user.email` or `$.data.items[0].name`).

### Filtering Arrays

Use **Filter** or **Filter By** to extract specific items from arrays based on criteria.

**Scenario:** Filter an array of users to include only those with a specific status.

1. On the **FIRST** row, select **Filter By**.
2. Provide the JSONata path to the property to filter on (e.g., `status`).
3. Enter the filter value (e.g., `"active"`).

**Output:** An array containing only objects where the specified property matches the filter value.

### Combining Data

Use **Prepend** to combine arrays or prepend values to arrays.

**Scenario:** Combine two arrays of IOCs into a single array.

1. On the **FIRST** row, select **Prepend**.
2. Provide the first array or value.
3. Provide the second array or value to prepend.

**Output:** A new array containing the prepended values followed by the original values.

## Best Practices

- **Start with Get Date/Time:** When working with dates, always start with **Get Date/Time** in the FIRST row to establish a base timestamp.
- **Chain Transformations:** Use THEN rows to chain multiple transformations together, building complex transformations from simple operations.
- **Parse JSON First:** When working with JSON strings, always use **Parse JSON** as the first transformation before extracting properties.
- **Test Incrementally:** Test each transformation step to ensure accuracy before adding subsequent transformations.
- **Use Appropriate Filters:** Choose **Filter** for simple value matching or **Filter By** for filtering objects by property values.

## Related Documentation

For more information on available transformations, see [Using the Transform Data Native Action](#).

For advanced transformation capabilities using JSONata expressions, see [Advanced Transformations](#).