Problems with setting sourcetype through transformations.conf

[quixand]

This is driving me mad - have gone through the documentation and responses to queries in here but still can't get sourcetype overrided by using a transform. I'm missing something, I'm guessing obvious, but not obvious to me!

inputs.conf

[monitor:///Users/admin/Documents/splunkDataToIndex/automation_logs/]  
disabled = 0  
followTail = 0  
index = automationlogs  

props.conf

[source::/Users/admin/Documents/splunkDataToIndex/automation_logs/...]  
TRANSFORMS-set_sourcetype_for_scriptlogs = set_sourcetype_for_scriptlogs  
priority = 10  

transforms.conf

[set_sourcetype_for_scriptlogs]  
SOURCE_KEY = MetaData:Source  
DEST_KEY = MetaData:Sourcetype  
REGEX = .*/(.*?)\..*  
FORMAT = Sourcetype::$1  

[carmackd]

Are you trying to extract the sourcetype out of the source field value?

i.e. ---> /Users/admin/Documents/splunkDataToIndex/automation_logs/

If so, your regex isnt matching anything.