Hello, I'm having some issues getting field extractions to work correctly. I've deployed the "TA-Windows-2008R2-Exchange-IIS" app to my CAS server, using the Universal Forwarder. I have the props.conf and transforms.conf in the same directory as the inputs.conf. But when I search the IIS logs on my search head, the fields defined in transforms.conf are not present. I'm sure I'm missing something here regarding the different between search-time and index-time field extractions, and the inability of the forwarder to parse data. Any help would be appreciated. ... View more