That actually isn't true....
I can re-assign all other "non-search" objects from the "All configurations" page:
- props-extract (except for source based or ones with sourcetypes with colons.... see examples below)
- transforms-extract
- views
- transforms-lookup
- macros
- eventtypes
- fvtags
- fieldaliases
- workflow-actions
The only thing missing completely is calculated fields which I cannot reassign from this UI which doesn't seem to make sense when we can reassign all other objects from the UI.
I can reassign all other extracted fields and field transformations from the UI. The only ones that I cannot reassign are the ones that are source-based or are sourcetype based with a colon in the sourcetype name.
Sourcetype example:
Sourcetype: wineventlog:taskscheduler
Name: WinEventLogTaskScheduler-EventCode103Message
Regex: Task Scheduler failed to launch action \"(?P<FailedAction>[^\"]+)\" in instance \"\{(?P<FailedInstance>[^\"]+)\}\" of task \"(?P<Task>[^\"]+)\"\. Additional Data\: Error Value\: (?P<ErrorValue>[^\.]+)\.
Field Extraction Name: wineventlog:taskscheduler : EXTRACT-WinEventLogTaskScheduler-EventCode103Message
***Please note the colon in the sourcetype name
Source example:
***I don't have a good source example that I would be able to post on here but for a fake example:
Source: this/is/a/pretend/source.log
Name: Destination
Regex: ^\w+\s\d+\s\d{2}:\d{2}:\d{2}\s(?<dest>\S+)
Field Extraction Name: source::this/is/a/pretend/source.log : EXTRACT-Destination
***Note that splunk adds the "source::" before the source.... I think the colons may be conflicting
I don't know for sure that the colon is the issue since I don't know how Splunk does the reassignment behind the scenes but based on some extensive testing I've done in my own environment (running on 8.1.3) this seems to be a common denominator....
I do have a bug investigation open with support to look into this issue.
