Hi to all. im setting an integration with Splunk and Splunk ES. I decided to send events via HEC method json format. I understand that in order to accept the events in Splunk ES i need to do 2 things. 1. build an Add on for parsing the info 2. load the data in data model. ill be happy to have several answers : 1. do i need to send the events via CEF Syslog or json format is good enough ? 2. what is the standard event we should send to Splunk? json, Syslog? CEF? ill be happy for you to explain the process for building an add on, how to load in data modal - CIM  thanks to all ... View more

Hi to all. I'm working at a startup company providing security solutions. I started research on how to integrate with Splunk, Splunk ES. for now, we choose to use the HEC method for delivering the data into Splunk cloud. I wanted to ask some questions.  do i need to create an add-on?  to integrate with Splunk SE what are the actions, I need to do? I understand this is the flow of actions -  load data using the HEC, parse data normalizing them, eventually, load data in Data Models, if you don't load data In data Models, create your Correlation Searches using indexes. I'll  be happy if someone will be able to elaborate more about each topic and tell me if something is missing.     ... View more