https://community.splunk.com/t5/Getting-Data-In/Export-to-Syslog/m-p/58474#M11495 <P>Sure. You can have Splunk forward on anything it indexes via syslog format. Generally, you configure the <EM>indexers</EM> to forward on syslog, not the forwarders. The thing to note is that Splunk's Windows Event Logs will have internal newline characters. It <EM>shouldn't</EM> cause any problems with receiving syslog agents, depending what they do with it though. I would nevertheless have you test it against your preferred receiver to see if you like the results.</P> <P><A href="http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems#Forward_syslog_data" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems#Forward_syslog_data</A></P> Mon, 14 Mar 2011 12:22:40 GMT gkanapathy 2011-03-14T12:22:40Z https://community.splunk.com/t5/Getting-Data-In/Export-to-Syslog/m-p/58473#M11494 <P>Hi All,</P> <P>Does anyone know if it's possible to take logs that have been grabbed from Windows WMI and indexed, and then forward them on to a syslog server?</P> <P>This is a requirement here that needs to be met before the Admins will consider the program... needless to say it's causing me some grief so I thought I'd put it out here and see if any guru's can point me in the right direction...</P> <P>Cheers,</P> <P>DB</P> Mon, 14 Mar 2011 11:41:37 GMT https://community.splunk.com/t5/Getting-Data-In/Export-to-Syslog/m-p/58473#M11494 Scarecrowddb 2011-03-14T11:41:37Z https://community.splunk.com/t5/Getting-Data-In/Export-to-Syslog/m-p/58474#M11495 <P>Sure. You can have Splunk forward on anything it indexes via syslog format. Generally, you configure the <EM>indexers</EM> to forward on syslog, not the forwarders. The thing to note is that Splunk's Windows Event Logs will have internal newline characters. It <EM>shouldn't</EM> cause any problems with receiving syslog agents, depending what they do with it though. I would nevertheless have you test it against your preferred receiver to see if you like the results.</P> <P><A href="http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems#Forward_syslog_data" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems#Forward_syslog_data</A></P> Mon, 14 Mar 2011 12:22:40 GMT https://community.splunk.com/t5/Getting-Data-In/Export-to-Syslog/m-p/58474#M11495 gkanapathy 2011-03-14T12:22:40Z