https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-set-up-Windows-Event-Viewer-forwarding-from/m-p/166064#M33674 <P>You can setup a WinEventLog input, and then create a scripted input set to a different index.</P> <P>I'd advise not worrying about that, and just have both groups use the same index. The events in the index shouldn't be modified, just the searches that filter the events. So it's perfectly ok for two groups to look at the same data in different ways.</P> Sat, 07 Mar 2015 03:47:09 GMT muebel 2015-03-07T03:47:09Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-set-up-Windows-Event-Viewer-forwarding-from/m-p/166063#M33673 <P>Is it possible to set up Windows Event Viewer forwarding from one server to multiple Splunk indexes?</P> <P>We're in a shared server environment, and another group has already setup forwarding for Event Viewer logs.</P> <P>Prefer having separate copy of logs for ease of querying/control over config changes.</P> Fri, 06 Mar 2015 22:26:25 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-set-up-Windows-Event-Viewer-forwarding-from/m-p/166063#M33673 jmt0806 2015-03-06T22:26:25Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-set-up-Windows-Event-Viewer-forwarding-from/m-p/166064#M33674 <P>You can setup a WinEventLog input, and then create a scripted input set to a different index.</P> <P>I'd advise not worrying about that, and just have both groups use the same index. The events in the index shouldn't be modified, just the searches that filter the events. So it's perfectly ok for two groups to look at the same data in different ways.</P> Sat, 07 Mar 2015 03:47:09 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-set-up-Windows-Event-Viewer-forwarding-from/m-p/166064#M33674 muebel 2015-03-07T03:47:09Z