I require to monitor windows event logs on my linux splunk server. I realize that i will likely have to convert the windows event logs to syslog-type logging -- does splunk recommend a software package to do this?
I'd like to do whatever splunk recommends works best with their system.
i think the best thing will be installing splunk as a forwarder on the windows box that you are trying to monitor.
Set the unix box as a receiver to accept connections from the windows forwarder.
This way you can install the windows app in both forwarder and receiver and be able to do a whole lot more..