We have two options to send our Splunk Cloud, Please suggest which option is best .
1) HF outputs syslog to LogStash and logstash pushes to HEC.
arcsight -> HF -> logstash -> HEC
2. Arcsight pushes to Nifi and nifi transforms and pushes to HEC
arcsight -> Nifi -> HEC
Why are those your only two options? Arcsight can produce syslog output so you also have these options:
3. Arcsight -> HF -> Splunk Cloud
4. Arcsight -> Splunk Connect for Syslog (SC4S) -> HEC
I recommend option 4 because it's easy to manage and performs well.