I just would like to point out that the use of the "-" (hyphen) on stanza names on the transforms.conf may cause some issues, like ignoring the transform:
[wowza-fields]
DELIMS = " "
FIELDS = "date","time","tz","x-event","x-category","x-severity","x-status","x-ctx","x-comment",...
Rather than that use underscore (Ex: "[wowza_fields]") and save lots of time : )
In my experience SPLUNK ignored the stanza defined on transforms.conf and the fields were not seen on the "field discovery" panel. Hope this helps!
... View more