In our case, other than network switches and routers, Syslog is the log of record and Splunk runs on all the VMs. Splunk isn’t forwarding syslog itself