We have splunk cloud, could it push to a heavy forwarder rather than into the indexers?
Yes, the iapp can push to heavy forwarders instead of indexers
