How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

Scenarios for exporting Cloud Logging data: Splunk This scenario shows how to export selected logs

from Cloud Logging to Pub/Sub for ingestion into Splunk. Splunk is a security information and event

management (SIEM) solution that supports several ways of ingesting data, such as receiving

streaming data out of Google Cloud through Splunk HTTP Event Collector (HEC) or by fetching data

from Google Cloud APIs through Splunk Add-on for Google Cloud. Using the Pub/Sub to Splunk

Dataflow template, you can natively forward logs and events from a Pub/Sub topic into Splunk HEC.

If Splunk HEC is not available in your Splunk deployment, you can use the Add-on to collect the logs

and events from the Pub/Sub topic. https://cloud.google.com/solutions/exporting-stackdriverlogging-for-splunk