WinEventLogs breaking the field extractions when sent to a third-party. Why?

[cleelakrishna]

Im able to Send the WinEventlogs to third party server through SYSLOG TCP port. But the props which i have created is breaking Field Extractions in TA_windows Addon. please Help me in solving the issue. below are the configurations which i used:

outputs.conf:

[syslog:my_syslog_group]
server = abcappls.abc.com:814
type = tcp

props.conf:

[source::WinEventLo*]
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=30
LINE_BREAKER = (\r\n)
KV_MODE=none
TRANSFORMS-routing = send_to_syslog
SEDCMD-win=s/(?mis)(Token Elevation Type indicates|This event is generated|Application Id=).*$//g
SEDCMD = s/[\n\r\t]/ /g

transforms.conf :

[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

I get the events as one liner to the third party system (which is correct) but my new PROPS have changed the Existing props which in turn get every thing as one line to splunk Indexer as well.

09/11/2017 09:38:32 PM LogName=Application SourceName=vmStatsProvider EventCode=256 EventType=0 Type=Information ComputerName=qwerty.loutap.chgfms.abcf TaskCategory=General OpCode=Info RecordNumber=1234567 Keywords=Classic Message=The "vmStatsProvider" is successfully initialized for this Virtual Machine. WMI namespace: "rofhjgfv2".

please help me with props.conf which should not change the Fields which are getting indexed into Indexer.

[DalJeanis]

You probably need to look at CLONE_SOURCETYPE. What that will do is copy the events from their initial state into another sourcetype, where the same events can proceed to be handled in a different way.

@rphilllips posted a really good description and use case over here - https://answers.splunk.com/answers/556300/how-can-i-use-clone-sourcetype-to-send-a-cloned-mo.html?ch...