Splunk windows logs to Snare central

[rajeshmetso]

Hi 

Am trying to collect the windows logs from DCs and send them to both Splunk indexer and Third party System (Snare Central). I managed to send the logs using syslog configuration. But some how the logs are getting broken. I want my log format to be in "snare over syslog". Please suggest.

UF => HF => Snare Central