Universal Forwarder functionality - Splunk Community

Splunk Search

Hi! I'm searching for an appropriate agent to transmit Windows Event log to syslog server.

Can Universal Forwarder convert Windows Event logs to syslog for transmitting log?

Best regards,

No, the Universal Forwarder cannot convert Windows event logs to syslog. The Heavy Forwarder, however, can do so. See https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Forwarddatatothirdpartysystems

What problem are you trying to solve?

---
If this reply helps you, Karma would be appreciated.

I appreciate your detailed explanation.

Currently, we are planning to transmit Windows event log of workstation (OS: Windows 7) to syslog server.

In this case, only heavy forwarder needs to be installed on the workstation? Is there any required additional software to transmit log?

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Build resilience for the agentic era: Join us at Splunk Go San Jose

AI is changing how organizations build, operate, and secure digital services. As teams adopt AI agents and ...

Manage Edge Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Edge Processor, onboard one instance, deploy a pipeline ...