Would this part of the documentation help? It has a subsection specifically on syslog input. Note that SplunkWeb is not available on universal forwarders, so you have to configure it using inputs.conf / outputs.conf using your favorite editor.
FWIW, the best practice for processing syslog events is to send them to a syslog/syslog-ng server, break out the various log sources / sourcetypes and write events to local files, which are then picked up by a UF.
This blog provides a good overview of how that works.
