https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-ingest-the-events-into-two-different-HEC/m-p/585199#M102963 <P>Splunk forwarder is running in the host and sending the audit logs to Splunk instances through HEC. Now i want to send debug logs to another instance through another HEC end point. Is that possible to configure to HEC end points in Splunk forwarder?</P> Thu, 17 Feb 2022 00:24:14 GMT rsahoo 2022-02-17T00:24:14Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-ingest-the-events-into-two-different-HEC/m-p/585199#M102963 <P>Splunk forwarder is running in the host and sending the audit logs to Splunk instances through HEC. Now i want to send debug logs to another instance through another HEC end point. Is that possible to configure to HEC end points in Splunk forwarder?</P> Thu, 17 Feb 2022 00:24:14 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-ingest-the-events-into-two-different-HEC/m-p/585199#M102963 rsahoo 2022-02-17T00:24:14Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-ingest-the-events-into-two-different-HEC/m-p/585204#M102964 <P>Judging from the docs, you could do the data cloning only with plain tcp outputs. Httpout doesn't seem to support multiple destinations.</P> Tue, 15 Feb 2022 17:01:54 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-ingest-the-events-into-two-different-HEC/m-p/585204#M102964 PickleRick 2022-02-15T17:01:54Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-ingest-the-events-into-two-different-HEC/m-p/585225#M102968 <P>I would say use outputs.conf to do data cloning.&nbsp;</P><LI-CODE lang="markup">[tcpout] defaultGroup=my_instance1, my_instance2 [tcpout:my_instance1] server=&lt;instance_1_ip&gt;:9997 [tcpout:my_instance2] server=&lt;instance_2_ip&gt;:9997 [tcpout-server://&lt;instance_1_ip&gt;:9997] [tcpout-server://&lt;instance_2_ip&gt;:9997]</LI-CODE><P><A href="https://docs.splunk.com/Documentation/Forwarder/8.2.4/Forwarder/Configureforwardingwithoutputs.conf" target="_blank">https://docs.splunk.com/Documentation/Forwarder/8.2.4/Forwarder/Configureforwardingwithoutputs.conf</A>&nbsp;</P><P>&nbsp;</P><P>Ofcourse this will send all data to both the Splunk instance. If you wish to do just for that HEC input, you can use TCP_ROUTING.</P><P>Reference to implement TCP rounting -&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad</A></P><P>&nbsp;</P> Tue, 15 Feb 2022 19:19:06 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-ingest-the-events-into-two-different-HEC/m-p/585225#M102968 VatsalJagani 2022-02-15T19:19:06Z