Splunk Search

Why aren't defined field transformations showing in the GUI?

twinspop
Influencer

A user created a field transform/extraction through the wizard in the GUI. The field extraction works for him, but he wants to share it. Changing the permissions for the field extraction worked as expected. But when he visits the field transformation screen (Settings -> Fields -> Field transformations), it's empty. As admin user, I cannot see his transforms either. Based on the GUI, they don't exist except as a reference in the Field extraction screen.

On the file system, in $splunk/etc/users/hisusername/app/local/transforms.conf, I see his transforms. I also see them referenced in $splunk/etc/users/hisusername/app/metadata/local.meta.

Splunk 6.4.1
SHC on, 4 members

0 Karma

lukejadamec
Super Champion

Review this section of the Admin manual for sharing knowledge objects.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Apparchitectureandobjectownership

0 Karma

twinspop
Influencer

I'm familiar. I'm also accustomed to seeing the objects in the GUI regardless of permissions. These transforms aren't found in the GUI, so permissions can't be adjusted there. Changing object permissions via conf files on the filesystem in a Search Head Cluster is not awesome.

0 Karma

lukejadamec
Super Champion

Obviously this is not your first time to the rodeo. However, since this is the first time you've seen the problem perhaps the user did not save the extraction correctly. Have you had the user recreate the extraction to verify that errors were not made while saving?

http://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/FXSavestep

0 Karma

twinspop
Influencer

The extraction works. And the transforms are in the conf and meta files. If there was a problem creating, I don't think either of those things would be true. Ticket opened.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...