Sure. Best practice is to have a syslog daemon receive the data, write it to a log file, and let a Splunk Universal Forwarder send that file to your indexers.
There are lots (well at least a couple) of good reasons for running a separate syslog capture process.
Firstly, irrespective of the choice of syslog server you don't lose log data on those occasions when the Splunk service has to be restarted. Syslog is by default UDP, and volatile. If you fail to capture it it is gone. Having a separate server ensures that the syslog capture is continuous, even if the forwarding is interrupted.
Secondly, if using syslog-ng the log data can be saved into meaningful hierarchical (user-definable) trees which can then be used further to add a layer of value in the indexing.
Sure. Best practice is to have a syslog daemon receive the data, write it to a log file, and let a Splunk Universal Forwarder send that file to your indexers.
Well then. Sweet point goodness for you kind sir.
Sure, you can have the UF listen to syslog directly. It can receive network data just like the indexer can.
Thats what I was thinking, but I was hoping there was a way to cut out the middle man of a syslog daemon. If there is no way to do this natively in Splunk I'll give you full and due karma goodness!