What is the best way to send events from a windows server to syslog?

[christianubeda]

I team!

I need to extract syslog ad events from a windows server and send them to my splunk forwarder.

I can not install the UF directly on the server because it will not have connectivity with the indexer.

My plan is to install a syslog on the server, send the events to the forwarder (on another machine on the same network) and from there to the indexer.

What is the best way to send events from a windows server to syslog?

Thank you!

[spayneort]

You could use a UF on another server as an intermediate forwarder.

https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/Configureanintermediateforwarder

Another option is to use Windows Event Forwarding (WEF) to send the events to the second server, then have the UF on that server send them to the indexer.