How to forward Windows logs from a Splunk indexer to a Syslog server?

[viverma5]

Hi,

We are collecting Windows logs from a universal forwarder in a Windows Splunk Indexer. Now, I want to collect those logs from the Splunk indexer in a SYSLOG server. Can I achieve this?

[mzax]

Splunk can do that. Please see:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Forwarddatatothird-partysystemsd

[pmdba]

If what you're saying is that you want to pass the Windows log data collected in Splunk on to another application like syslog, then I don't think Splunk is engineered to do that; it takes data in and indexes it, but doesn't really have a way to forward it on to other apps. I believe you would do better to configure Windows to pass the data directly to syslog, not through Splunk, especially if Splunk is running on Windows too.

[viverma5]

Splunk sends multiline windows events (as in case of Syslog default log size) but do not offer any token to combine those multi-line logs. How can I tackle this?