Can we use REST API instead of Universal Forwarder to send logs to indexer, if so, How can we do that?

[saicool]

How can we send the logs through REST API without using the Universal forwarder on the application server or any sources

[xpac]

Hey,
the best way to do this is the Splunk HTTP Event Collector. It's a HTTP(S) API, that you can send your events to.
There is a lot to be considered for this, but the documents explain it pretty well. Check this:

Set up and use HTTP Event Collector in Splunk Web
Introduction to Splunk HTTP Event Collector

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂