I have a very small app that is installed in our Splunk Cloud instance. in props.conf I have [access_combined] REPORT-access_combined = REPORT-extract_app_from_source and in transforms.conf [REPORT-extract_app_from_source] SOURCE_KEY = source REGEX = [regex to extract app attribute] This has been working perfectly to extract the variable app from the source during searches. I have made a separate unrelated update to the app and now I am getting a failure when Splunk Cloud is vetting the app. check_pretrained_sourcetypes_have_only_allowed_transforms - Only TRANSFORMS- or SEDCMD options are allowed for pretrained sourcetypes. What is now the correct way to add these search time attributes?
... View more