Using Splunk as a log forwarder itself?

[gjones4]

I'm looking at Splunk to possibly replace a Kiwi Syslog server, however I don't see one of the features that Kiwi provides for us in Splunk. Logs collected in our Kiwi server are also forwarded to another server for alerting and whatnot. Can I use Splunk to collect syslogs, then in turn forward those collected logs to another appliance?

[yannK]

Universal forwarders can collect syslog data,
but only heavy forwarders and indexers (using the splunk core installer) can forward syslog data.

see http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Forwarddatatothird-partysystemsd#Syslog_dat...

[gjones4]

so, just for claification:

I set up my Splunk server to receive syslog data from my various devices, but then also configure it as a "heavy forwarder" to send that collected data to a 3rd party device?