Well, it just works this way. See the invaluable Masa diagrams - https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590774 An event passes through the indexing pipeline and at the end it's being written to a local index or (here the alternative is non-exclusive) getting sent out to output(s). The important thing is that it's still the same event. So you cannot modify an event only for a single output. The only way to make it work with transforms would be to clone the event using CLONE_SOURCETYPE into a separate sourcetype and only this instance subject to modifications and only those events send to your syslog output. Since you want to retain your sourcetype you'd have to save it into a field (which you'd have to remove in the original pipeline after cloning). It is an ugly solution however, not intuitive and might be confusing to maintain. One caveat - a transform-based solution will not work on events which had already been parsed. With a sufficiently modern Splunk (it's introduced in 10.0) you could also try using Edge Processor.
... View more
