Please let me know what is the best way to forward Window logs in parallel from current ArcSight ESM infra to Splunk Infra in Cloud. Here are the possible solutions which I could think of. Please let me know which one is the best.
1) Place a Splunk Forwarder between data sources and ArcSight SmartConnector
2) Place a Syslog Server and Splunk Forwarder after ArcSight SmartConnector in parallel to ESM
3) Place an independent Splunk Forwarder to forward a separate instance of logs to Splunk cloud
Currently Window logs are going to ArcSight and now we've requirement to send one copy of logs to Splunk.