Splunk HEC events to arcsight

Getting Data In

Is it possible to send Splunk HEC events message part to 3rd party collector/arcsight?

Eg... Now it is :

Logstash --- SplunkHEC/ HF --- Indexer

I want to parse message field in the HEC and send to arcsight collector before being send to indexers.

Is it possible?
Kindly help.

Get Updates on the Splunk Community!

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Ditch the Manual Grind: Building AI Agents with Splunk Let’s be real: your team’s time is being eaten alive. ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Join the Conversation