The app for salesforce is now available on prem : https://splunkbase.splunk.com/app/3549/ ... View more

When I go Field Transformations to look for this it isnt there, not even under the All category. I see. It looks like the Field Transformations settings page only supports REGEX/FORMAT-based transforms and not DELIMS/FIELDS-based ones. Do you have REST API access to the search head? If so, you should be able to use the REST API directly to fix up the transform. For example, something like: curl -sku admin:admin_password https://searchhead-hostport/servicesNS/original_owner/search/configs/conf-transforms/REPORT-LoadTest1/acl -d sharing=app -d perms.read=* -d owner=original_owner ... View more