You may want to try checking on each part of the files from the beginning to the end.. Are your events being indexed by Splunk without any field extractions? If the event is parsed but the fields are not extracted, ensure that fields that are being used in props.conf are being found correctly (e.g. The host field matches the stanza in props.conf [host::123.456.789.001]) You may want to test this by creating a test stanza that points directly to the source, for example [source::/some/dir/with/a/test.file] Ensure that your transforms.conf contains the correct capture groups for extracting your variables, there are several ways to do this and you will want to check against the documentation for using config files to perform field extractions and also with the transforms.conf.spec You also want to make sure that you do not have the Field Discovery toggle set to "Off" as this will hide the extracted fields from the search UI. (see pictures below) To see fields Fields hidden ... View more