splunk forwarder works well too