How can I have the 'HF' to forward specific logs to indexer and also transfer itself with syslog format?

[yutaka1005]

I want HF to forward specific logs(tcp input from 514 port) to indexer, and also transfer them itself with syslog format.

By the way, I configured like below, but its not working.

props.conf

[source::tcp:514]
TRANSFORMS-out = tcp_output, syslog_output

transforms.conf

[tcp_output]
REGEX  =  .
DEST_KEY = _TCP_ROUTING
FORMAT = tcp_output

[syslog_output]
REGEX  =  .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_output

outputs.conf

[tcpout:tcp_output]
server=<indexer>:9997
sendCookedData=false

[syslog:syslog_output]
server=localhost:10514
sendCookedData=false

Are these settings wrong?
If someone can tell me about it, I really appreciate it.

[FrankVl]

What exactly is your goal with this? Do you have a syslog daemon running that listens on 10514 to receive that copy of the data? Also, can you clarify what "doesn't work" means in this case? Does nothing work, or is it just the syslog stream that is not functioning?

It is usually recommended to put that syslog daemon in front of Splunk. Such that the syslog daemon receives the syslog data, writes it to disk and then splunk monitors those files.

Also: why do you have sendCookedData=false for the output to the indexer?