I wanted to comment on this to see if you were still looking for a solution. If so, please reply. I have not implemented a solution myself, but we began working on an integration with splunk and decided to go another route. I do think I can give you some valuable info, though. If you are interested, please reply here.