Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server?

[rashid47010]

We have different syslog sources.
Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server and then install the UF to read the files from that paths?

Please share some scenarios or Splunk configuration.

[rgreer]

What you outlined is exactly what we ended up doing in each of our data centers. Kiwi Syslog on a virtual machine with a UF pulling in each log with the correct sourcetype. Our corporate IT guys ended up using Rsyslog on a Redhat VM with a UF as well. Both ended up being cheap, cost effective solutions to our syslog problem.

[xpac]

On purpose or not, you ended up doing the best practice for that kind of use case. 😉
Syslog server writing to disk and Splunk monitoring those files is the recommended approach.