Splunk Search

How to change existing field transformation via gui

rrovers
Contributor

I have created a field transformatie via the gui of splunk. I want to add a field in this transformation.

If I open the field transformation (settings-fields-field transformation) the already existing fields are not visible.

Is it possible to change the existing fields via the gui?

Labels (1)
0 Karma

rrovers
Contributor

It had to do with my rights in the specific app. In the search app I can create the field transformation and extraction and change it afterwards

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Then it's easiest to select that app first. Then Settings -> Fields -> Transformation. 

Those should be there if you have created those earlier under that app. Then just click transformation name and change it as need.

If this is not working, can you add screenshot here so we can better understood what is the situation?

r. Ismo

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If you have rights to change (write) to those then you can change those via GUI too. You must select the correct app and owner and/or visible vs created in app. Then you could see those and also change those. In default you can see only your own transforms created in current app.

r. Ismo

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...