Why aren't defined field transformations showing in the GUI?

[twinspop]

A user created a field transform/extraction through the wizard in the GUI. The field extraction works for him, but he wants to share it. Changing the permissions for the field extraction worked as expected. But when he visits the field transformation screen (Settings -> Fields -> Field transformations), it's empty. As admin user, I cannot see his transforms either. Based on the GUI, they don't exist except as a reference in the Field extraction screen.

On the file system, in $splunk/etc/users/hisusername/app/local/transforms.conf, I see his transforms. I also see them referenced in $splunk/etc/users/hisusername/app/metadata/local.meta.

Splunk 6.4.1
SHC on, 4 members

[lukejadamec]

Review this section of the Admin manual for sharing knowledge objects.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Apparchitectureandobjectownership

[twinspop]

I'm familiar. I'm also accustomed to seeing the objects in the GUI regardless of permissions. These transforms aren't found in the GUI, so permissions can't be adjusted there. Changing object permissions via conf files on the filesystem in a Search Head Cluster is not awesome.

[lukejadamec]

Obviously this is not your first time to the rodeo. However, since this is the first time you've seen the problem perhaps the user did not save the extraction correctly. Have you had the user recreate the extraction to verify that errors were not made while saving?

http://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/FXSavestep

[twinspop]

The extraction works. And the transforms are in the conf and meta files. If there was a problem creating, I don't think either of those things would be true. Ticket opened.