I'm looking at Splunk to possibly replace a Kiwi Syslog server, however I don't see one of the features that Kiwi provides for us in Splunk. Logs collected in our Kiwi server are also forwarded to another server for alerting and whatnot. Can I use Splunk to collect syslogs, then in turn forward those collected logs to another appliance?
Universal forwarders can collect syslog data,
but only heavy forwarders and indexers (using the splunk core installer) can forward syslog data.
so, just for claification:
I set up my Splunk server to receive syslog data from my various devices, but then also configure it as a "heavy forwarder" to send that collected data to a 3rd party device?