Hi, we have upgraded vmware app to 3.4.0 and vmware is on 6.5.. we are forwarding vCenter logs to a HF which has Splunk_TA_vCenter, and we did make sure to change the inputs monitor path accordingly, but the regex in props and transforms is not extracting the sourcetype... #our custom inputs on HF inputs.conf [monitor:///var/log/vmware_hosts/vcenter-*.myorg/messages*] disabled = 0 sourcetype = vclog host_segment = 4 index = vmware-vclog #props and transforms are from Splunk_TA_vCenter props.conf [vclog] SHOULD_LINEMERGE = false TRANSFORMS-vmwvclogsourcetype = set_vclog_sourcetype transforms.conf #Sourcetype Extraction [set_vclog_sourcetype] REGEX = ^([a-z\-]+) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::vmware:vclog:$1 ... View more