How to add prefix string to events before forwarding to external server?

[Zanusha443]

Hi everybody,

I would like to duplicate data coming from my sourcetype in such a way:

- send the original data to Splunk for indexing.

- send the duplicated events to an external server with "<DNS>" prefix string.

How should I modify the transform.conf file in order to do that?

Another question: is there a better way to forwards logs to external server while keeping the original source  host (source IP) instead of adding prefixes like what I'm trying to do. 

Thanks in advance,

Angelo