Re: Universal Forwarder functionality - Splunk Community

Splunk Search

Hi! I'm searching for an appropriate agent to transmit Windows Event log to syslog server.

Can Universal Forwarder convert Windows Event logs to syslog for transmitting log?

Best regards,

No, the Universal Forwarder cannot convert Windows event logs to syslog. The Heavy Forwarder, however, can do so. See https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Forwarddatatothirdpartysystems

What problem are you trying to solve?

---
If this reply helps you, Karma would be appreciated.

I appreciate your detailed explanation.

Currently, we are planning to transmit Windows event log of workstation (OS: Windows 7) to syslog server.

In this case, only heavy forwarder needs to be installed on the workstation? Is there any required additional software to transmit log?

Get Updates on the Splunk Community!

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Enriching Signals with the OTel Lookup Processor

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...