Receiving events directly on the Splunk indexer