I am trying to configure props/transforms in a custom TA to perform some search-time field extractions for a custom event source. I have no issues creating the REGEX extraction in props.conf but when I try to use my REGEX as a report in transforms I don't have any luck. in metadata/default.meta I have this: [] access = read : [ * ], write : [ admin ] export = system In props.conf I have: [sourcetype] REPORT-fields = fields_extract In transforms.conf I have: [fields_extract] REGEX = regex(?<field1>\S+)\s(?<field2>\S+) Background: I need to extract and name the fields for this sourcetype. Some events which describe errors contain fields within the data that don't exist in other events. My plan is to have one regex that works on every event and another regex that matches starting on the error description to pull out the extra fields. I understand how to call two reports on one line but for some reason I can't get my extraction to work in transforms, only in props. ... View more