https://community.splunk.com/t5/Getting-Data-In/Can-a-forwarder-be-configured-to-two-indexers-without-load/m-p/95853#M19958 <P>Sure.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configureforwarderswithoutputs.confd#Data_cloning">http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configureforwarderswithoutputs.confd#Data_cloning</A></P> Fri, 19 Oct 2012 08:11:53 GMT Ayn 2012-10-19T08:11:53Z https://community.splunk.com/t5/Getting-Data-In/Can-a-forwarder-be-configured-to-two-indexers-without-load/m-p/95852#M19957 <P>I have tried quite unsuccessfully to search for an answer to achieve this configuration, so I'm asking here. Hopefully someone has a suggestion/solution to my kind of unusual configuration requirement. </P> <P>Is it possible to configure a forwarder to send to two separate indexers without load balancing, so that both indexers receive all the data independently?</P> <P>I understand this is an atypical situation, however, this is something I need to achieve. The indexers will be unable to communicate with each other and will be combined indexer/search heads, so they can't share the received data or be searched in a distributed fashion.</P> <P>I would suppose it would be possible to run two forwarders on the monitored host(s) one forwarding out to each indexer, but this would be a I/O hog and wasteful of system resources. As a result it would be highly desirable to send to both indexers from a single instance of the forwarder on the monitored host.</P> <P>Has anyone done this? Is it even possible?</P> <P>Thanks,<BR /> Joe</P> Fri, 19 Oct 2012 07:43:51 GMT https://community.splunk.com/t5/Getting-Data-In/Can-a-forwarder-be-configured-to-two-indexers-without-load/m-p/95852#M19957 mce128 2012-10-19T07:43:51Z https://community.splunk.com/t5/Getting-Data-In/Can-a-forwarder-be-configured-to-two-indexers-without-load/m-p/95853#M19958 <P>Sure.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configureforwarderswithoutputs.confd#Data_cloning">http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configureforwarderswithoutputs.confd#Data_cloning</A></P> Fri, 19 Oct 2012 08:11:53 GMT https://community.splunk.com/t5/Getting-Data-In/Can-a-forwarder-be-configured-to-two-indexers-without-load/m-p/95853#M19958 Ayn 2012-10-19T08:11:53Z https://community.splunk.com/t5/Getting-Data-In/Can-a-forwarder-be-configured-to-two-indexers-without-load/m-p/95854#M19959 <P>WOW... Don't know how I missed THAT in the docs...</P> <P>Thanks!</P> Fri, 19 Oct 2012 17:12:17 GMT https://community.splunk.com/t5/Getting-Data-In/Can-a-forwarder-be-configured-to-two-indexers-without-load/m-p/95854#M19959 mce128 2012-10-19T17:12:17Z