Guiseppe,
You could use App for CEF https://splunkbase.splunk.com/app/1847/
We are using it to send data in CEF format to ArcSight, only downside to this is, you have to use a standalone searchhead, as you can't use it in a searchheadcluster.
Hope this answers your question.
Bob
... View more