topic Universal Forwarder functionality in Splunk Search

Universal Forwarder functionality

kevinsteeee — Mon, 28 Sep 2020 17:34:44 GMT

Hi! I'm searching for an appropriate agent to transmit Windows Event log to syslog server.

Can Universal Forwarder convert Windows Event logs to syslog for transmitting log?

Best regards,

richgalloway — Mon, 28 Sep 2020 18:07:15 GMT

No, the Universal Forwarder cannot convert Windows event logs to syslog. The Heavy Forwarder, however, can do so. See https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Forwarddatatothirdpartysystems

What problem are you trying to solve?

kevinsteeee — Tue, 29 Sep 2020 18:04:43 GMT

I appreciate your detailed explanation.

Currently, we are planning to transmit Windows event log of workstation (OS: Windows 7) to syslog server.

In this case, only heavy forwarder needs to be installed on the workstation? Is there any required additional software to transmit log?