Getting Data In

What is the recommended method using a Splunk forwarder to send Window logs to Splunk Cloud and to ArcSight ESM?

ravish
New Member

Hi,

Please let me know what is the best way to forward Window logs in parallel from current ArcSight ESM infra to Splunk Infra in Cloud. Here are the possible solutions which I could think of. Please let me know which one is the best.

1) Place a Splunk Forwarder between data sources and ArcSight SmartConnector
2) Place a Syslog Server and Splunk Forwarder after ArcSight SmartConnector in parallel to ESM
3) Place an independent Splunk Forwarder to forward a separate instance of logs to Splunk cloud

Currently Window logs are going to ArcSight and now we've requirement to send one copy of logs to Splunk.

Thanks..

0 Karma

curryRick
Explorer

If I were to need to do this, I would follow what is suggested in the "Forward data to third-party systems" documentation article at http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Forwarddatatothird-partysystemsd. If the data source is not in CEF format, then you might consider using the Splunk App for CEF ( https://splunkbase.splunk.com/app/1847/ ) and use outputs.conf to define how to get this data sent to ArcSight.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...