Index time props and transforms not working

[splunkIT]

I have the following props & transforms in splunk dev and prod environment monitoring the same set of iis logs:

props.conf

[source::/var/www/logs/someiislog2*]
CHECK_FOR_HEADER=false
TZ = UTC
pulldown_type = true
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = false
EXTRACT-SiteID = (?W3SVC\d+) in source
REPORT-iisFields= iis-c
SEDCMD-001TrimWhiteSpace = s/(\s)\s+/\1/g
SEDCMD-002RemoveCookie = s/(.*\s\d{1,}\.\d{1,}\.\d{1,}\.\d{1,})\s\S+\s(\S+\s.*)/\1 - \2/g
TRANSFORMS-ToIisSourceType = forcetoIISsourcetype

transforms.conf

[iis-c]
DELIMS = " "
FIELDS = date, time, cs_method, cs_uri_stem, cs_uri_query, c_ip, cs_Cookie, cs_Referer, cs_host, sc_status, sc_bytes, time_taken

[forcetoIISsourcetype]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::iis

Everything works in dev, but in prod, none of the index-time stuff (SEDCMD and TRANSFORMS-ToIisSourceType ) appears to be working. I have checked the splunkd.log but did not find any relevant message.

How can I further troubleshoot this issue? Which debug parameters can I enable to gather more information?

[woodcock]

If it works in Dev then the only thing that could be wrong is that you have not put the files in the right place on your Indexers or that you have not restarted the Splunk instances on your Indexers. You did restart Splunk on your Indexers, right?

[linu1988]

Obvious, but are they placed in indexers?

[landen99]

Is there a UF in here and which Splunk clients have your props settings?