splunk 4.1.4 not transforming an apache access log

I have a Splunk 4.1.4 install which is indexing some apache access logs. Unfortunately, when I try to produce reports on the logs, it doesn't seem to have done the fields transform so all the url, useragent, etc fields are missing.

The weird thing is, in the fields column on the left hand side of the search view, it says "All 68 fields" but if I click that to add more fields, the dialog box that appears says "Available fields (24)".

The initial query I did was;

host="gromit" sourcetype="access_combined"

The entry for the field transform seems to be there in /opt/splunk/etc/system/default;

REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?[[all:other]]

Am I doing something wrong?