https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-multiple-indexes/m-p/628195#M107817 <P>Hello Experts..</P> <P>Configuring the inupts.conf file I am trying to send data from the same windows log to multiple index's for separate dashboards. I think some sort precedence is blocking some of the data.</P> <P>Here is what I was trying to accomplish. Is there a better way to get where I'm trying to go?</P> <P>&nbsp;</P> <LI-CODE lang="markup">[WinEventLog://Application] disabled = 0 index = WINDOWS start_from = oldest [WinEventLog://System] disabled = 0 index = WINDOWS start_from = oldest [WinEventLog://Security] disabled = 0 index = WINDOWS start_from = oldest ######## Separate to send USB bus traffic ########## [WinEventLog://Security] disabled = 0 index = USB start_from = oldest whitelist = 1234,4321,5467, etc [WinEventLog:/Microsoft-Windows-DriverFrameworks-UserMode/Operational] disabled = 0 index = USB start_from = oldest interval = 1000,1001,1002,1003</LI-CODE> <P>&nbsp;</P> Wed, 25 Jan 2023 18:35:41 GMT KCM 2023-01-25T18:35:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-multiple-indexes/m-p/628195#M107817 <P>Hello Experts..</P> <P>Configuring the inupts.conf file I am trying to send data from the same windows log to multiple index's for separate dashboards. I think some sort precedence is blocking some of the data.</P> <P>Here is what I was trying to accomplish. Is there a better way to get where I'm trying to go?</P> <P>&nbsp;</P> <LI-CODE lang="markup">[WinEventLog://Application] disabled = 0 index = WINDOWS start_from = oldest [WinEventLog://System] disabled = 0 index = WINDOWS start_from = oldest [WinEventLog://Security] disabled = 0 index = WINDOWS start_from = oldest ######## Separate to send USB bus traffic ########## [WinEventLog://Security] disabled = 0 index = USB start_from = oldest whitelist = 1234,4321,5467, etc [WinEventLog:/Microsoft-Windows-DriverFrameworks-UserMode/Operational] disabled = 0 index = USB start_from = oldest interval = 1000,1001,1002,1003</LI-CODE> <P>&nbsp;</P> Wed, 25 Jan 2023 18:35:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-multiple-indexes/m-p/628195#M107817 KCM 2023-01-25T18:35:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-multiple-indexes/m-p/628203#M107818 <P>The current approach won't work because Splunk combines the settings for each stanza name.&nbsp; In the example, all WinEventLog:Security data will go to the USB index because it is specified last.</P><P>The better method is to not even try to separate the data by index.&nbsp; Like data should be in the same index and separated at search time.</P> Tue, 24 Jan 2023 20:19:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-multiple-indexes/m-p/628203#M107818 richgalloway 2023-01-24T20:19:18Z