Hi I am new to splunk. I set up a single-site cluster to parse a JSON-formatted log. I use cm in the path of /opt/splunk/etc/manager-apps/_cluster/local. conf and transforms.conf configuration files were sent to index in the path /opt/splunk/etc/peer-apps/_cluster/local. However, when I searched in the search header, the desired effect was not found. props.conf [itsd] DATETIME_CONFIG = CURRENT KV_MODE = json LINE_BREAKER = ([\r\n]+) category = Structured disabled = false pulldown_type = true TRANSFORMS-null1 = replace_null TRANSFORMS-null2 = replace_null1   transforms.conf [replace_null] REGEX = ^\[ DEST_KEY=queue FORMAT=nullQueue [replace_null1] REGEX=(.*)(\}\s?\}) DEST_KEY=_raw FORMAT=$1$2 ... View more