If I POST events to a heavy forwarder using the REST API receivers/simple web service, will the HF be able to parse and forward the data?

[csmartin]

If I POST events to a Heavy Forwarder using the receivers/simple web service, will the Forwarder then be able to parse and forward the data? Is this standard behavior when using the REST API?

I want to do this because I have Forwarders on-premise that forward to Indexers in the cloud. I would like to keep the same pattern for these events rather than bypassing the on-premise Forwarders.

[Jeremiah · Accepted solution]

Yes, if you configure your heavy forwarder to forward data to an indexer, it will forward any data it receives, regardless if that data is received via the HTTP event collector, a port configured as an input, or through a monitor or script stanza.

Here's some information on forwarder topologies:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Forwarderdeploymenttopologies

And event collector topologies:
http://dev.splunk.com/view/event-collector/SP-CAAAE73

[csmartin]

many thanks Jeremiah