Getting Data In

If I POST events to a heavy forwarder using the REST API receivers/simple web service, will the HF be able to parse and forward the data?

New Member

If I POST events to a Heavy Forwarder using the receivers/simple web service, will the Forwarder then be able to parse and forward the data? Is this standard behavior when using the REST API?

I want to do this because I have Forwarders on-premise that forward to Indexers in the cloud. I would like to keep the same pattern for these events rather than bypassing the on-premise Forwarders.

0 Karma
1 Solution

Motivator

Yes, if you configure your heavy forwarder to forward data to an indexer, it will forward any data it receives, regardless if that data is received via the HTTP event collector, a port configured as an input, or through a monitor or script stanza.

Here's some information on forwarder topologies:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Forwarderdeploymenttopologies

And event collector topologies:
http://dev.splunk.com/view/event-collector/SP-CAAAE73

View solution in original post

0 Karma

Motivator

Yes, if you configure your heavy forwarder to forward data to an indexer, it will forward any data it receives, regardless if that data is received via the HTTP event collector, a port configured as an input, or through a monitor or script stanza.

Here's some information on forwarder topologies:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Forwarderdeploymenttopologies

And event collector topologies:
http://dev.splunk.com/view/event-collector/SP-CAAAE73

View solution in original post

0 Karma

New Member

many thanks Jeremiah

0 Karma