I realise this is possible sacrilegious, but here goes.
We're looking to move all our Splunk stuff over to Google Chronicle. We used an app on Splunk cloud that is no longer supported, so this needs to be done as quickly as possible.
Eventually we will replace the Splunk forwarders with an agnostic solution, but until then I figure we might just be able to use the current heavy forwarder and direct it to the Chronicle instance.
Is it as simple as this sounds, or am I really oversimplifying?
