Hi Thanks for your reply. This is possibly a wider issue with taking in Syslog data from multiple sources and how I, in an attempt to source type the data, have created multiple input sources on udp so now this app is looking for syslog data on the standard port. I thought I could just change the inputs.conf file for the app to point to the unique port. But the transforms do not appear to be working. Any idea how to "debug" an app to see what's actually going on between input and transforms? Thanks ... View more