Splunk Search
Highlighted

Why aren't defined field transformations showing in the GUI?

Influencer

A user created a field transform/extraction through the wizard in the GUI. The field extraction works for him, but he wants to share it. Changing the permissions for the field extraction worked as expected. But when he visits the field transformation screen (Settings -> Fields -> Field transformations), it's empty. As admin user, I cannot see his transforms either. Based on the GUI, they don't exist except as a reference in the Field extraction screen.

On the file system, in $splunk/etc/users/hisusername/app/local/transforms.conf, I see his transforms. I also see them referenced in $splunk/etc/users/hisusername/app/metadata/local.meta.

Splunk 6.4.1
SHC on, 4 members

0 Karma
Highlighted

Re: Why aren't defined field transformations showing in the GUI?

Super Champion

Review this section of the Admin manual for sharing knowledge objects.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Apparchitectureandobjectownership

0 Karma
Highlighted

Re: Why aren't defined field transformations showing in the GUI?

Influencer

I'm familiar. I'm also accustomed to seeing the objects in the GUI regardless of permissions. These transforms aren't found in the GUI, so permissions can't be adjusted there. Changing object permissions via conf files on the filesystem in a Search Head Cluster is not awesome.

0 Karma
Highlighted

Re: Why aren't defined field transformations showing in the GUI?

Super Champion

Obviously this is not your first time to the rodeo. However, since this is the first time you've seen the problem perhaps the user did not save the extraction correctly. Have you had the user recreate the extraction to verify that errors were not made while saving?

http://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/FXSavestep

0 Karma
Highlighted

Re: Why aren't defined field transformations showing in the GUI?

Influencer

The extraction works. And the transforms are in the conf and meta files. If there was a problem creating, I don't think either of those things would be true. Ticket opened.

0 Karma