Send Windows Logs to thrid party without Splunk adding in new syslog header

[jmcclure]

I can send a subset of windows data as syslog server by sourcetype and then use the TransFroms to REGEX out the host.

None of this works though if Splunk puts a timestamp server header on each syslog message.

I have tried the

syslogSourceType = sourcetype::WinEventLog:Security, but this doesn't work.

Am I missing anything?

[davpx]

You can try using sendCookedData=false as in https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd#Forwa...