doc/from_base64: Emphasize keyword only values

Emphasize that specifying the keyword only will result in the defaults
for each option to be used.

Issue: 7853

diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst
index 5c0527aa50abe4766fb3c6254bc4a908eafd5dea..1de2c401e9b8af35e1000709678831ae4c6f0855 100644 (file)
--- a/doc/userguide/rules/transforms.rst
+++ b/doc/userguide/rules/transforms.rst
@@ -246,12 +246,16 @@ The option values must be ``,`` separated and can appear in any order.
 Format::
 
     from_base64: [[bytes <value>] [, offset <offset_value> [, mode: strict|rfc4648|rfc2045]]]
+    from_base64
 
 There are defaults for each of the options:
 - ``bytes`` defaults to the length of the input buffer
 - ``offset`` defaults to ``0`` and must be less than ``65536``
 - ``mode`` defaults to ``rfc4648``
 
+The second example shows the rule keyword only which will cause the default values for each option to
+be used.
+
 Note that both ``bytes`` and ``offset`` may be variables from `byte_extract` and/or `byte_math` in
 later versions of Suricata. They are not supported yet.