fields via transforms...

[a212830]

Hi,

I've created some fields via transforms, and they work fine in the search app. However, they do not appear in any other app. I put the transforms in the ../etc/system/local transforms, and assumed that would guarantee that the fields would appear everywhere. Is there a way to get them to appear everywhere?

[_d_]

Yes, if transforms.conf is placed in etc/system/local/ it will be available to all users. If you leave it in the search app you need to make sure that it is exported properly to all other apps. Look into the .meta file documentation for more details: http://docs.splunk.com/Documentation/Splunk/6.0/admin/Defaultmetaconf