This is an interesting use case. This does certainly look like an ideal use case for the http event collector on the heavy forwarder, here are a few reasons why: The heavy forwarder with http event collector is built for this sort of demand Lightweight is relative, a solution needs to be available and resilient and scalable. Depending on how your network topology is segmented, you'll want a heavy forwarder with an http event collector (not an indexer) as close to the edge as possible: http://dev.splunk.com/view/event-collector/SP-CAAAE73 . see Scenario 2 & 3. You didn't mention if this was for internet facing http calls, but I'm assuming they are. Reusability, should similar use cases arise in the future, you now have a solution that can be shared with other application needs. Cheers ... View more