Arcsight to HEC

[sahiltcs]

We have two options to send  our Splunk Cloud, Please suggest which option is best .

1) HF outputs syslog to LogStash and logstash pushes to HEC.

arcsight -> HF -> logstash -> HEC

2. Arcsight pushes to Nifi and nifi transforms and pushes to HEC

arcsight -> Nifi -> HEC

[richgalloway]

Why are those your only two options?  Arcsight can produce syslog output so you also have these options:

3. Arcsight -> HF -> Splunk Cloud

4. Arcsight -> Splunk Connect for Syslog (SC4S) -> HEC

I recommend option 4 because it's easy to manage and performs well.