Dear Splunkers, really sorry for my question , I do feel that reply would be on another thread(couldn't find it), but i try to forward custom application access logs to  Splunk, giving specific tag-name to each column let's say(i would define it by regular expression), sending only "matching" data. I 've already set inputs.conf with the file path, index and sourcetype and successfully see full logs on Splunk search but whole info on event data . Still not sure where to set appropriate configuration(props.conf, tranform.conf, ?) for getting only Invoked Service, Caller IP and Response Code let's say since we are referring to Access Logs.  ... View more