how to send syslog events from cloud to splunk enterprise

[dall]

how to send syslog events from prisma cloud to splunk enterprise

[richgalloway]

The recommended approach is to have the source send syslog events to a dedicated syslog server and have that server forward the events to Splunk.  The syslog server can be a Linux box running rsyslog or syslog-ng or a Docker container running Splunk Connect for Syslog (SC4S).  The last one is easiest to use.

See https://splunkbase.splunk.com/app/4740/ or https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html