How to change existing field transformation via gui

[rrovers]

I have created a field transformatie via the gui of splunk. I want to add a field in this transformation.

If I open the field transformation (settings-fields-field transformation) the already existing fields are not visible.

Is it possible to change the existing fields via the gui?

[rrovers]

It had to do with my rights in the specific app. In the search app I can create the field transformation and extraction and change it afterwards

[isoutamo]

Then it's easiest to select that app first. Then Settings -> Fields -> Transformation. 

Those should be there if you have created those earlier under that app. Then just click transformation name and change it as need.

If this is not working, can you add screenshot here so we can better understood what is the situation?

r. Ismo

[isoutamo]

Hi

If you have rights to change (write) to those then you can change those via GUI too. You must select the correct app and owner and/or visible vs created in app. Then you could see those and also change those. In default you can see only your own transforms created in current app.

r. Ismo