Getting Data In

ArcSight and Splunk

New Member


From you earlier post, I understand that you have integrated Splunk with ArcSight and so I would request if you please help me to understand a few question here,

What should be the SIEM architecture in a scenario where I have ArcSight Manager, Logger and connector and now I want to integrate Splunk for long term data retention purpose. I find that long term data retention is not a good cost effective option with ArcSight Logger and also searching performance is very slow in archived data since it does not contain index information. Also please send me the integration document between ArcSight and Splunk.

Tags (2)
0 Karma


Have a look at this document. While this provides the basics, I believe that more in depth work would be needed to properly map the Windows audit logs.


I think you've misunderstood the purpose of splunkbase. It is not a general forum for communicating requests to Splunk sales. It is a questions/answers sites where volunteers help out with issues and queries regarding designing, implementing and operating Splunk installations. As such, my suggestion is that you get in contact with Splunk sales.