Getting Data In

What is the recommended method using a Splunk forwarder to send Window logs to Splunk Cloud and to ArcSight ESM?

New Member


Please let me know what is the best way to forward Window logs in parallel from current ArcSight ESM infra to Splunk Infra in Cloud. Here are the possible solutions which I could think of. Please let me know which one is the best.

1) Place a Splunk Forwarder between data sources and ArcSight SmartConnector
2) Place a Syslog Server and Splunk Forwarder after ArcSight SmartConnector in parallel to ESM
3) Place an independent Splunk Forwarder to forward a separate instance of logs to Splunk cloud

Currently Window logs are going to ArcSight and now we've requirement to send one copy of logs to Splunk.


0 Karma


If I were to need to do this, I would follow what is suggested in the "Forward data to third-party systems" documentation article at If the data source is not in CEF format, then you might consider using the Splunk App for CEF ( ) and use outputs.conf to define how to get this data sent to ArcSight.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>