Splunk Windows Events to Third Party System

[solman07]

Hello all, implementing some routing at the moment in order to forward a subset of data to a third party syslog system. However, i'm running into issues with the Windows Logs. They look like this at syslog-NG 

Dec 29 07:47:18 12/29/2014 02:47:17 AM

Dec 29 07:47:18 LogName=Security

Dec 29 07:47:18 SourceName=Microsoft Windows security auditing.

Dec 29 07:47:18 EventCode=4689

Dec 29 07:47:18 EventType=0

I believe this is because of the /r/n in the Windows events caused by non-xml  How can i get the Splunk Heavy Forwarder to treat each Windows event as one line and then send it through? 

Architecture = UF - HF - Third Party System/Splunk Cloud 

Thanks 

[PickleRick]

Windows logs are... tricky. Whichever way you want to peocess them. If you want to use third party solution that pushes to Splunk, you have tons of problems with parsing. If you want to use Splunk to forward events to a third party receiver you get issues like this.

Unfortunately, syslog receivers don't play nice with multiline events.

What you could try is change the format of windows events to xml (which is advised anyway), do a copy of your windows events with CLONE_SOURCETYPE, remove line ends from the event with a transform applied to that new sourcetype and route that sourcetype to your syslog output. Might work, might not, just an idea from the top of my head.