I heard from Venafi support that the Splunk channel is going away... the Syslog channel is the recommended method moving forward. so where/how do I point my syslog configurations to feed splunk
The recommended approach for sending syslog to Splunk is to set up a server with a syslog daemon (rsyslog / syslog-ng) that receives the syslog data and writes it to file. Then install a Universal Forwarder on that same server to read those files and send it to your indexer(s). The advantage of this is, that the syslog feed is not interrupted when you need to stop / restart splunk (e.g. for maintenance / upgrade of the UF / deploying new inputs). Also the way a syslog daemon can nicely generate dynamic files (e.g. one file per hour per source host) makes it easier to process the data in splunk (e.g. take hostname from path) and troubleshoot in case of issues with the feed.
A somewhat simpler, less robust, option is to set up a TCP or UDP input directly in Splunk and point Venafi to send syslog to that port.
