Hey eddieddieddie, Not sure if you've resolved this already but your props.conf and transforms.conf need to be on your HF as well for the transforms you're expecting to work. https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F Hope this helps (or that you had already resolve this). Thanks, Greg ... View more