Using syslog to forward data or Universal forwarder

[andywt123]

I have setup splunk 6.1.1. In our environment we are running rsyslog in a failover configuration.
Rsyslog is collecting all the data and then forwarding the data to Splunk. Splunk is configured
with a tcp receiver on port 514. The one issue we are running into is we are getting a large number
of entries that are not syslog compliant. We are then getting hosts with names such as 2014,14z etc.
I am looking for advice on what would be the best way to reduce these errors? Would the universal forwarder work better at detecting log types and then forwarding it to Splunk?

[bcdady]

Depending on what information / insights you're looking for, there might be certain info needed from forwarders, in order to put the right data in the right indexes to make the Apps work as designed.
SplunkForwarder can collect metrics / stats from Windows, Linux, etc. that are often not easily attainable via syslog (See About forwarding and receiving).

How many syslog sources are you sending through your rsyslog, and what OS are they?
If you aren't sure how to track any possible trends related to where the malformed log entries, then setting up Deployment and installing forwarders instead of syslog could definitely help you clean up your data (format errors), as well as provide additional data to bring the apps to life.