If I have an environment with an rsyslog collection server that is working just fine and collecting from thousands of endpoints, should I keep that or get rid of that and collect events using a UF on each endpoint?
You will always need a syslog server but there are many good reasons to go with syslog-ng. I would not make this change unless you frequently need to adjust what is sent and you cannot admin directly. With UFs/DS you can admin all of your splunk configurations by yourself
Keep your rsyslog server for the syslog collection and install an universal forwarder on the same server to monitor the files the rsyslog server creates. Some good background information is available here http://www.georgestarcher.com/splunk-success-with-syslog/
