How to separate logs receiving on syslog port 514 to separate table during ingestion and avoid duplication.

Hi @Givary-MSFT,I already followed above steps you mentioned also followed blog - https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/split-microsoft-sentinel-tables-with-multi-destination-data/ba-p/3849526

Steps Followed:

1. I created a simple DCR rule at AMA Syslog data collector, added below in DataFlow section of its template by editing it, to send logs to table.

               "dataFlows": [
                    {
                        "streams": [
                            "Microsoft-Syslog"
                        ],
                        "destinations": [
                            "DataCollectionEvent"
                        ],
                        "transformKql": "source | where Facility == \"auth\" | extend RawData = pack(\"value\", SyslogMessage)| project TimeGenerated, RawData, Application=\"Syslog Custom\"",
                        "outputStream": "Custom-MyTest_CL"
                    }
                ]
            }
        }
    ]

2. I created a table with custom DCR rule and added below in transformation query using sample log.

Sample log:

[
    {
        "RawData":  {
                        "value":  "May  6 12:34:56 localhost sshd[1234]: Accepted password for user from ipAddess port ssh2 (locale: en_US.UTF-8)"
                    },
	   "Application":  "LogGenerator",
	   "EventTime": "2024-05-03T17:13:52.3267Z"
    }
]

Transformation Script 3. So when I checked logs in table, its creating some default fields and only the constant field which I added in transformKQL from step1 Application= Syslog Custom", and not other fields which I gave in project statement.

I am not getting how transformKql in step1 will get mapped to source in step2.

Let me know what I am doing wrong, why its not adding syslogMessage field here.