use transforms.conf or props.conf to convert multi line event to single event on forwarder level to send external to Splunk

[ssyed2009]

I would like to convert an event similar to the one below to be a single event when sending it out to an external Syslog server

---

time: 20180717112345
dn: uid=123,ou=employees,ou=ddd,ou=ddd,o=ddd,dc=ddd,dc=ddd
changetype: modify
replace: userPassword

userPassword: #####

replace: modifiersName
modifiersName: uid=ddd,ou=ddd,ou=ddd,ou=ddd,o=ddd,dc=ddd,

dc=ddd

replace: modifyTimestamp

modifyTimestamp: 20180717112345Z

replace: accountUnlockTime

replace: passwordRetryCount

passwordRetryCount: 0

replace: retryCountResetTime

replace: pwdFailureTime

replace: pwdAccountLockedTime

---

[CarsonZa]

a uf will ignore props and transforms, you will need a heavy forwarder on your syslog server.

[ssyed2009]

I have a heavy forwarder on the rsyslog server but the rsyslog is taking each line as a separate event