If you transfer the data into a Splunk instance through Splunk Forwarders, you'll enjoy three benefits: TCP connection and bandwidth throttling. The security of an SSL connection for transferring information from the Forwarder to an Indexer. Splunk's design is such that the data sent onto the Indexer is automatically balanced.
Suppose one Indexer is shut down for reasons beyond its control. The data will be redirected to another Indexer instance very quickly. In addition, Splunk Forwarders cache the events locally before sending them and creates an interim backup of the information.
