How to send Windows events to indexer and also to third-party server (single line events) using Splunk Heavy Fowarder?

[cleelakrishna]

I am trying to send the data from Heavy Forwarder to INDEXERs and THIRD PARTY system (non splunk) but 3rd party system is receiving the logs in Multiline Events (which is not accepted by 3rd party server).
Dec 29 07:47:18 12/29/2014 02:47:17 AM
Dec 29 07:47:18 LogName=Security
Dec 29 07:47:18 SourceName=Microsoft Windows security auditing.
Dec 29 07:47:18 EventCode=4689
Dec 29 07:47:18 EventType=0
i'm getting correct format on my indexers . But I need single line events in 3rd party server, please help me in configuration changes to send the data in single line events.

These are the configurations files which I have currently:

**outputs.conf**:
[syslog:syslog_group]
server = syslog.abc.com:514
type = tcp

**Props.conf:**
[source::WinEventLo*]
TRANSFORMS-routing = send_to_syslog

**transforms.conf:**
[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_group

What changes do I need to make in order to receive single line events only to 3rd party system.

[ipteam]

Use _syslog_routing in

inputs.conf :

_SYSLOG_ROUTING = server1, server2

and outputs.conf

[syslog:server1]
server = x.x.x.x:port
type=tcp

[syslog:server2]
server = x.x.x.x:port
type=tcp