How can we send our firewall logs directly to an indexer (without a heavy forwarder)?

[nabhosal]

We have two indexers and 1 search head in our environment.
We are going to integrate a Cisco ASA firewall with Splunk.
Can we send it directly to an indexer instead of a heavy forwarder?

[gjanders]

While I agree with adonio here, you can do this, the question is why would you want to?

By removing the heavy or universal forwarder layer and pointing directly to an indexer you are introducing a single point of failure (ideally you should have a load balancer in front of multiple forwarders if receiving data), and you are going to have an uneven balance of data in the cluster.

Since the balance of data will be uneven then the majority of the searches may end up running on 1 indexer when you query the data...I would not recommend you do this.

If the concern is the parsing occurring on the HF level you could put universal forwarders in front of your indexers instead and just have them to forward the data in a balanced fashion to the indexers...

[adonio]

Yes you can.
open UDP input in the indexer and point the firewall data to the indexer.
read here:
http://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Monitornetworkports
you will probably lose your data load balancing between the 2 indexers capability
but maybe you can configure it to do so on your Cisco ASA firewall
hope it helps