No, this cannot be done using Splunk. It's generally best practice to use a separate syslog daemon for receiving syslog and having Splunk read the files it creates. That way you can solve the particular problem you have, and you're also more free to perform maintenance on Splunk without having to worry about losing syslog data. See more (and similar) information here: http://answers.splunk.com/answers/1513/is-there-a-way-to-maintain-the-source-ip-of-the-udp-syslog-packet-when-forwarding-to-a-3rd-party-syslog-listener ... View more