Trouble forwarding splunkd.log output to syslog.

[rdupuis]

I must be missing something very simple here so bear with me.
I am running a Splunk universal forwarder instance, and I would like to forward its internal logs (e.g. splunkd.log) to my own Syslog server.

I would like to do this for my own internal audit logging separate from the indexer that is connected to the forwarder. Is there any support for this?
I have tried to set up rsyslog to watch splunkd.log but there seem to be some inotify shenanigans going on and rsyslog fails to recognize that the log file is being updated.

[yannK]

To have a UF forward to syslog, check
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

Keep in mind that if a forwarder send to a splunk indexer AND to a syslog server. It will stop sending to both if one of them is not responding, not great for HA.