Hi All, I am ingesting some logs from Heavy Forwarder and then sending them to indexers. *Snippet from inputs.conf on the Universal Forwarder [monitor:///opt/splunk/etc/apps/nonprod_apicalls/local/ce_p2_srv_data2_env_getstats_port.txt] disabled = false sourcetype = my:api:ce2 index = internet I would like to extract "data2" text from the filename.  I did a rex field extraction on search head and it works giving me "instance" field name under interesting fields on Search UI. Below is the regex I used | rex field=source "\/(.+\/)(?:[^_]+_[^_]+_[^_]+_)(?<instance>[^_]+)"   So next step I did is created props.conf with below configuration [my:api:ce2] EXTRACT-instance = \/(.+\/)(?:[^_]+_[^_]+_[^_]+_)(?<instance>[^_]+) in source   Restarted the splunk service on Heavy Forwarder, but it doesn't work. Can someone advise me if I am doing something wrong here or what is the issue. Thankyou Harry ... View more