If you use a connector appliance to manage your ArcSight connectors you can just add a new destination and point it at your Splunk server. Add Destination > Create a new destination > Raw Syslog. Enter IP/Host, Port, Protocol (UDP), and select 'false' for metadata. Enable a UDP syslog listener on the port you specified for your destination and have Splunk read the file. This was my feedback in this similar question I had this configuration working for a transition from arcsight to Splunk. You'll need a little bit of custom parsing on the Splunk side to get everything correct. ... View more

Use Sharepoint's REST API to dump list data as XML and then index https://mySPsite.com/sites/mySProot/_api/web/lists/getbytitle('MyListName')/Items Then ingest into splunk and index https://answers.splunk.com/answers/187195/how-to-add-and-parse-xml-data-in-splunk.html ... View more