Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: If I POST events to a heavy forwarder using th...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I POST events to a Heavy Forwarder using the receivers/simple web service, will the Forwarder then be able to parse and forward the data? Is this standard behavior when using the REST API?
I want to do this because I have Forwarders on-premise that forward to Indexers in the cloud. I would like to keep the same pattern for these events rather than bypassing the on-premise Forwarders.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, if you configure your heavy forwarder to forward data to an indexer, it will forward any data it receives, regardless if that data is received via the HTTP event collector, a port configured as an input, or through a monitor or script stanza.
Here's some information on forwarder topologies:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Forwarderdeploymenttopologies
And event collector topologies:
http://dev.splunk.com/view/event-collector/SP-CAAAE73
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, if you configure your heavy forwarder to forward data to an indexer, it will forward any data it receives, regardless if that data is received via the HTTP event collector, a port configured as an input, or through a monitor or script stanza.
Here's some information on forwarder topologies:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Forwarderdeploymenttopologies
And event collector topologies:
http://dev.splunk.com/view/event-collector/SP-CAAAE73
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
many thanks Jeremiah
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Catalog Is Now Generally Available on Splunk Cloud Platform
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
