What is the recommended method using a Splunk forwarder to send Window logs to Splunk Cloud and to ArcSight ESM?

[ravish]

Hi,

Please let me know what is the best way to forward Window logs in parallel from current ArcSight ESM infra to Splunk Infra in Cloud. Here are the possible solutions which I could think of. Please let me know which one is the best.

1) Place a Splunk Forwarder between data sources and ArcSight SmartConnector
2) Place a Syslog Server and Splunk Forwarder after ArcSight SmartConnector in parallel to ESM
3) Place an independent Splunk Forwarder to forward a separate instance of logs to Splunk cloud

Currently Window logs are going to ArcSight and now we've requirement to send one copy of logs to Splunk.

Thanks..

[curryRick]

If I were to need to do this, I would follow what is suggested in the "Forward data to third-party systems" documentation article at http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Forwarddatatothird-partysystemsd. If the data source is not in CEF format, then you might consider using the Splunk App for CEF ( https://splunkbase.splunk.com/app/1847/ ) and use outputs.conf to define how to get this data sent to ArcSight.