First you need to identify what the format is it JSON/syslog/CEF etc is supposed to be.
Then you need to install the TA which you have on a HF and in cloud SH.
Then you need to ensure the TA on the HF has been configured with the correct options, you will most likely need to ensure the Guardicore system is configured for the format your require, or the default options - Speak to the Guardicore admin.
From the Splunk base there appears not to be any detailed documentation but it does state the TA uses REST API and processes events received from the Syslog exporter. So, sounds like the TA app will have the config options to pull data.
