If I POST events to a Heavy Forwarder using the receivers/simple web service, will the Forwarder then be able to parse and forward the data? Is this standard behavior when using the REST API?
I want to do this because I have Forwarders on-premise that forward to Indexers in the cloud. I would like to keep the same pattern for these events rather than bypassing the on-premise Forwarders.
Yes, if you configure your heavy forwarder to forward data to an indexer, it will forward any data it receives, regardless if that data is received via the HTTP event collector, a port configured as an input, or through a monitor or script stanza.
Here's some information on forwarder topologies:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Forwarderdeploymenttopologies
And event collector topologies:
http://dev.splunk.com/view/event-collector/SP-CAAAE73
Yes, if you configure your heavy forwarder to forward data to an indexer, it will forward any data it receives, regardless if that data is received via the HTTP event collector, a port configured as an input, or through a monitor or script stanza.
Here's some information on forwarder topologies:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Forwarderdeploymenttopologies
And event collector topologies:
http://dev.splunk.com/view/event-collector/SP-CAAAE73
many thanks Jeremiah