I really didn't find much documentation on migrating from Splunk to Chronicle SIEM, but the basic architecture would be to configure Splunk to forward the logs to outputs.conf, pointing to the Chonicle Forwarder. Splunk must have the CIM Add-on insta...