topic Re: How to change existing field transformation via gui in Splunk Search

How to change existing field transformation via gui

rrovers — Tue, 19 Apr 2022 06:29:24 GMT

I have created a field transformatie via the gui of splunk. I want to add a field in this transformation.

If I open the field transformation (settings-fields-field transformation) the already existing fields are not visible.

Is it possible to change the existing fields via the gui?

Re: How to change existing field transformation via gui

isoutamo — Tue, 19 Apr 2022 06:33:06 GMT

If you have rights to change (write) to those then you can change those via GUI too. You must select the correct app and owner and/or visible vs created in app. Then you could see those and also change those. In default you can see only your own transforms created in current app.

r. Ismo

Re: How to change existing field transformation via gui

rrovers — Fri, 22 Apr 2022 12:24:59 GMT

It had to do with my rights in the specific app. In the search app I can create the field transformation and extraction and change it afterwards

Re: How to change existing field transformation via gui

isoutamo — Fri, 22 Apr 2022 12:44:15 GMT

Then it's easiest to select that app first. Then Settings -> Fields -> Transformation.

Those should be there if you have created those earlier under that app. Then just click transformation name and change it as need.

If this is not working, can you add screenshot here so we can better understood what is the situation?

r. Ismo