For system monitoring or reading logs it might be the right solution using a forwarder. But if I want to input events from within an application directly into Splunk (e.g. for application monitoring) the REST API seems to be a better choice.
What are you looking to achieve by submitting these through the REST API interface rather than just, say, syslog? Authentication, encryption? You might be better off with using a forwarder that will give you this as well.