Hi,
I want to extract, and report on (also, put in a summary index), some standard fields from access logs. I have a standard multi-tier setup (uf, indexer, and search-head). I have the props.conf and transforms.conf, but my question is where should they go? Indexer, or search-head?