Here is my props and transforms props.conf [default] TRANSFORMS-save_original_sourcetype = save_original_sourcetype TRANSFORMS-clone_for_thirdparty = clone_for_thirdparty [data_to_thirdparty] SHOULD_LINEMERGE = true TRANSFORMS-updateFields = sourcetype_raw_updated TRANSFORMS-route_thirdparty = route_thirdparty transforms.conf # 1. Save original sourcetype as a field (for use in the clone) [save_original_sourcetype] SOURCE_KEY = MetaData:Sourcetype REGEX = (.+) FORMAT = orig_sourcetype::$1 WRITE_META = true # 2. Clone only events from vme_ops_prod to sourcetype=data_to_thirdparty [clone_for_thirdparty] SOURCE_KEY = _MetaData:Index REGEX = ^test_np$ DEST_KEY = MetaData:Sourcetype CLONE_SOURCETYPE = data_to_thirdparty WRITE_META = true # 3. Meta-data transforms for the clone [sourcetype_raw_updated] SOURCE_KEY=MetaData:orig_sourcetype REGEX=^orig_sourcetype::(.*)$ FORMAT = $1##$0 DEST_KEY=_raw # 4. Route the cloned event ONLY to thirdparty [route_thirdparty] SOURCE_KEY = _MetaData:Index REGEX = (^test_np.*) DEST_KEY = _TCP_ROUTING FORMAT = dev_thirdparty   I'm sending logs (no cooked data) to thirdpartyserver over TCP without disturbing existing flow. so I just cloned the event and adding original sourcetype to the cloned event and sending to thirdparty output group. now the issue here is I can't find the original source type.   ... View more

I just want to add the orig_sourcetype to the cloned event with original sourcetype value. ... View more

@livehybrid  @PickleRick  @gcusello  Thanks for your responses. I found in the Splunk documentation that forwarding logs to third-party systems is typically done over TCP. I tried using TCP, but I did not receive Splunk metadata like host, sourcetype, source, and index on the third-party system. ... View more

Thanks for your answer,  I found in the Splunk documentation that forwarding logs to third-party systems is typically done over TCP. I tried using TCP, but I did not receive Splunk metadata like host, sourcetype, source, and index on the third-party system ... View more