Can my app log via TCP or SSL straight to indexer?

[srubik]

I'm new to Splunk, but from everything I've seen I absolutely love it. I have a C# application that clients can download and use, and I'd like to use Splunk to monitor errors in the application. Rather than force clients to install the forwarder on their machine, I thought that maybe I can send log data via TCP or SSL straight to the indexer (preferably SSL). Will the indexer understand TCP/SSL data from an application other than the Splunk forwarder? How do I handle certs? Does the REST API support logging to the indexer, or is the REST API more for management and add-ons? I couldn't find any way to log from the REST API.

I was also planning on using Amazon's EC2 to host the indexer, and have my search head in my environment. I'll point my search head to the EC2 instance. Just curious if anyone sees any problems with this approach or if anyone has tried that before. I've seen Splunk deployed on EC2, and I've seen the distributed splunk architecture, but I haven't found an example where someone deployed only the indexer on EC2 and had the search head somewhere else. To give you a little background (so you don't call me completely nuts!) I plan on having a separate indexer in my environment for my backend stuff, and my search head would hit both the client facing indexer on EC2 and my back-end indexer.

[drippler]

I know this is old, but you should notice that security is not perfect when you want users to send events directly to splunk, as you'll have to give excessive permissions to the user that authenticates from the client side.

[Damien_Dallimor]

You most certainly can send events to your Splunk Indexer directly from your application code.

There are 2 HTTP REST endpoints for this , receivers/simple & receivers/stream
This channel is actually HTTPS , so that would be your SSL route.

You can also send events directly to a TCP port.
Setup a TCP port in Splunk (in inputs.conf on your Indexer), and then in your C# code, open a socket and just write out the raw event on the wire, preferably in best practice format.
You can even use the REST API to dynamically setup/teardown the TCP port on your Splunk Indexer.

Furthermore, there is a C# SDK coming very soon , and we currently have SDK's for Python, Java, Javascript

It's not C#, but is syntactically similar, so check out some of these Java examples for the above mentioned scenarios :

https://gist.github.com/3290922
https://gist.github.com/3270757
https://gist.github.com/3270758