Heavy forwarder and third-party system problem

[KhalidAlharthi]

i have faced problem with Qradar and transformation of log (Trend micro)

i forwarded the log as a raw format from splunk HF to Qradar 

i'm facing problem with the header of the events on Qradar they have double hostname and timestamp (date)

i tried to define syslogSourcetype = sourcetype::<sourcetype> 

but same occuers they are double 

is there a way to solve this problem please i'm trying now for 1 week to solve this issue

Thanks