Yes, using Quagga + ospfd. Logs get sent to an anycast syslog server IP, which routes to an actual syslog server, which has the Splunk forwarder running on it.
Kogane, could you please elaborate a little on your post? I'm aware Quagga is a fork of Zebra, how did you config syslog to forward to anycast?
We just have syslog on our hosts configured to send data to "sysloghost", which resolves to an anycast IP. The actual syslog servers are the ones running quagga/ospfd.