<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How does splunk indexing works when two or more windows based collector sending same Event logs? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-does-splunk-indexing-works-when-two-or-more-windows-based/m-p/20402#M2985</link>
    <description>&lt;P&gt;Thank you for the quick answer.&lt;/P&gt;</description>
    <pubDate>Tue, 31 Jul 2012 02:01:09 GMT</pubDate>
    <dc:creator>AKG</dc:creator>
    <dc:date>2012-07-31T02:01:09Z</dc:date>
    <item>
      <title>How does splunk indexing works when two or more windows based collector sending same Event logs?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-does-splunk-indexing-works-when-two-or-more-windows-based/m-p/20400#M2983</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;

&lt;P&gt;We have two collector server collecting events from all windows based servers(400 of them). Windows servers are currently set to send locally generated events to the both collectors(duplicate).&lt;/P&gt;

&lt;P&gt;we are wanting to install splunk agents in both servers and forward all collected events to the central splunk server&lt;/P&gt;

&lt;P&gt;Now we have following questions&lt;/P&gt;

&lt;P&gt;1) How does license restriction will work e.g. will we have to buy double the size licenses?&lt;BR /&gt;
2) While indexing will duplicate event logs be indexed?&lt;/P&gt;

&lt;P&gt;Thanks in advance.&lt;/P&gt;</description>
      <pubDate>Mon, 30 Jul 2012 00:48:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-does-splunk-indexing-works-when-two-or-more-windows-based/m-p/20400#M2983</guid>
      <dc:creator>AKG</dc:creator>
      <dc:date>2012-07-30T00:48:57Z</dc:date>
    </item>
    <item>
      <title>Re: How does splunk indexing works when two or more windows based collector sending same Event logs?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-does-splunk-indexing-works-when-two-or-more-windows-based/m-p/20401#M2984</link>
      <description>&lt;P&gt;Yes to both.&lt;/P&gt;</description>
      <pubDate>Mon, 30 Jul 2012 12:35:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-does-splunk-indexing-works-when-two-or-more-windows-based/m-p/20401#M2984</guid>
      <dc:creator>sowings</dc:creator>
      <dc:date>2012-07-30T12:35:41Z</dc:date>
    </item>
    <item>
      <title>Re: How does splunk indexing works when two or more windows based collector sending same Event logs?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-does-splunk-indexing-works-when-two-or-more-windows-based/m-p/20402#M2985</link>
      <description>&lt;P&gt;Thank you for the quick answer.&lt;/P&gt;</description>
      <pubDate>Tue, 31 Jul 2012 02:01:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-does-splunk-indexing-works-when-two-or-more-windows-based/m-p/20402#M2985</guid>
      <dc:creator>AKG</dc:creator>
      <dc:date>2012-07-31T02:01:09Z</dc:date>
    </item>
  </channel>
</rss>

