Universal Forwarder functionality - Splunk Community

Splunk Search

Hi! I'm searching for an appropriate agent to transmit Windows Event log to syslog server.

Can Universal Forwarder convert Windows Event logs to syslog for transmitting log?

Best regards,

No, the Universal Forwarder cannot convert Windows event logs to syslog. The Heavy Forwarder, however, can do so. See https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Forwarddatatothirdpartysystems

What problem are you trying to solve?

---
If this reply helps you, Karma would be appreciated.

I appreciate your detailed explanation.

Currently, we are planning to transmit Windows event log of workstation (OS: Windows 7) to syslog server.

In this case, only heavy forwarder needs to be installed on the workstation? Is there any required additional software to transmit log?

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...