Splunk Search

How to change existing field transformation via gui

rrovers
Contributor

I have created a field transformatie via the gui of splunk. I want to add a field in this transformation.

If I open the field transformation (settings-fields-field transformation) the already existing fields are not visible.

Is it possible to change the existing fields via the gui?

Labels (1)
0 Karma

rrovers
Contributor

It had to do with my rights in the specific app. In the search app I can create the field transformation and extraction and change it afterwards

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Then it's easiest to select that app first. Then Settings -> Fields -> Transformation. 

Those should be there if you have created those earlier under that app. Then just click transformation name and change it as need.

If this is not working, can you add screenshot here so we can better understood what is the situation?

r. Ismo

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If you have rights to change (write) to those then you can change those via GUI too. You must select the correct app and owner and/or visible vs created in app. Then you could see those and also change those. In default you can see only your own transforms created in current app.

r. Ismo

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...