Universal Forwarder functionality

[kevinsteeee]

Hi! I'm searching for an appropriate agent to transmit Windows Event log to syslog server.

Can Universal Forwarder convert Windows Event logs to syslog for transmitting log?

Best regards,

[richgalloway]

No, the Universal Forwarder cannot convert Windows event logs to syslog.  The Heavy Forwarder, however, can do so.  See https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Forwarddatatothirdpartysystems

What problem are you trying to solve?

[kevinsteeee]

I appreciate your detailed explanation. 

Currently, we are planning to transmit Windows event log of workstation (OS: Windows 7) to syslog server. 

In this case, only heavy forwarder needs to be installed on the workstation? Is there any required additional software to transmit log?