https://community.splunk.com/t5/Getting-Data-In/WinEventLogs-breaking-the-field-extractions-when-sent-to-a-third/m-p/330783#M61304 <P>You probably need to look at CLONE_SOURCETYPE. What that will do is copy the events from their initial state into another sourcetype, where the same events can proceed to be handled in a different way. </P> <P>@rphilllips posted a really good description and use case over here - <A href="https://answers.splunk.com/answers/556300/how-can-i-use-clone-sourcetype-to-send-a-cloned-mo.html?childToView=556305#answer-556305">https://answers.splunk.com/answers/556300/how-can-i-use-clone-sourcetype-to-send-a-cloned-mo.html?childToView=556305#answer-556305</A></P> Tue, 12 Sep 2017 23:29:48 GMT DalJeanis 2017-09-12T23:29:48Z https://community.splunk.com/t5/Getting-Data-In/WinEventLogs-breaking-the-field-extractions-when-sent-to-a-third/m-p/330782#M61303 <P>Im able to Send the WinEventlogs to third party server through SYSLOG TCP port. But the props which i have created is breaking Field Extractions in TA_windows Addon. please Help me in solving the issue. below are the configurations which i used:</P> <P>outputs.conf:</P> <P>[syslog:my_syslog_group]<BR /> server = abcappls.abc.com:814<BR /> type = tcp</P> <P>props.conf:</P> <P>[source::WinEventLo*]<BR /> SHOULD_LINEMERGE = true<BR /> MAX_TIMESTAMP_LOOKAHEAD=30<BR /> LINE_BREAKER = (<A href="https://community.splunk.com/?=d%7B2%7D/d%7B2%7D/d%7B2,4%7D%20d%7B2%7D:d%7B2%7D:d%7B2%7D%20%5BaApPmM%5D%7B2%7D" target="_blank">\r\n</A>)<BR /> KV_MODE=none<BR /> TRANSFORMS-routing = send_to_syslog<BR /> SEDCMD-win=s/(?mis)(Token Elevation Type indicates|This event is generated|Application Id=).*$//g<BR /> SEDCMD = s/[\n\r\t]/ /g</P> <P>transforms.conf :</P> <P>[send_to_syslog]<BR /> REGEX = .<BR /> DEST_KEY = _SYSLOG_ROUTING<BR /> FORMAT = my_syslog_group</P> <P>I get the events as one liner to the third party system (which is correct) but my new PROPS have changed the Existing props which in turn get every thing as one line to splunk Indexer as well.</P> <P><STRONG>09/11/2017 09:38:32 PM LogName=Application SourceName=vmStatsProvider EventCode=256 EventType=0 Type=Information ComputerName=qwerty.loutap.chgfms.abcf TaskCategory=General OpCode=Info RecordNumber=1234567 Keywords=Classic Message=The "vmStatsProvider" is successfully initialized for this Virtual Machine. WMI namespace: "rofhjgfv2".</STRONG></P> <P>please help me with props.conf which should not change the Fields which are getting indexed into Indexer.</P> Tue, 29 Sep 2020 15:43:23 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLogs-breaking-the-field-extractions-when-sent-to-a-third/m-p/330782#M61303 cleelakrishna 2020-09-29T15:43:23Z https://community.splunk.com/t5/Getting-Data-In/WinEventLogs-breaking-the-field-extractions-when-sent-to-a-third/m-p/330783#M61304 <P>You probably need to look at CLONE_SOURCETYPE. What that will do is copy the events from their initial state into another sourcetype, where the same events can proceed to be handled in a different way. </P> <P>@rphilllips posted a really good description and use case over here - <A href="https://answers.splunk.com/answers/556300/how-can-i-use-clone-sourcetype-to-send-a-cloned-mo.html?childToView=556305#answer-556305">https://answers.splunk.com/answers/556300/how-can-i-use-clone-sourcetype-to-send-a-cloned-mo.html?childToView=556305#answer-556305</A></P> Tue, 12 Sep 2017 23:29:48 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLogs-breaking-the-field-extractions-when-sent-to-a-third/m-p/330783#M61304 DalJeanis 2017-09-12T23:29:48Z