If I were to need to do this, I would follow what is suggested in the "Forward data to third-party systems" documentation article at http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Forwarddatatothird-partysystemsd. If the data source is not in CEF format, then you might consider using the Splunk App for CEF ( https://splunkbase.splunk.com/app/1847/ ) and use outputs.conf to define how to get this data sent to ArcSight. ... View more

I've not used Hyper-V, but have run Splunk under VMware. Splunk used to discourage virtual environments, but now they warn about performance degradation. See Deploying Splunk Enterprise Inside Virtual Environments for details. ... View more