Depends on what you're forwarding – if it's syslog, you probably want a syslog collector
If it's not syslog, use the UF (or HEC) – unless you can't reliably get UFs deployed and maintained … then use a syslog collector, and "fake" the logs into syslog to ingest into Splunk from the collector
July 22, 2020 at 12:58PM
via reddit https://www.reddit.com/r/Splunk/comments/hvx280/event_log_forwarding_does_it_matter_which_way_you/fyw0isg?utm_source=ifttt