First part of the puzzle is solved. Tags are now assigned correctly. Installing the add-on on the indexer layer and the search head took care of this. My bad for only installing the add-on on the Universal Forwarder layer.
Filtering is still not working though, props and transforms look OK, sourcetype is correctly selected, transformation is correctly defined, seems like the regular expression is not matching the event data. REGEX=200 should match any event with 200 in its data or ?
... View more