https://community.splunk.com/t5/Getting-Data-In/Can-we-have-the-same-source-forwarding-data-to-two-different/m-p/276031#M52951 <P>As part of the upgrade we are planning to deploy Splunk 6.3 on a new set of physical servers.<BR /> We have around 217 forwarders sending data in the existing infrastructure.<BR /> Can we have the forwarders configured to send data to the existing infrastructure as well as the new 6.3 enterprise cluster?</P> <P>The thought behind this is to have existing infrastructure intact while we upgrade the new infrastructure.</P> Wed, 09 Dec 2015 23:27:07 GMT athorat 2015-12-09T23:27:07Z https://community.splunk.com/t5/Getting-Data-In/Can-we-have-the-same-source-forwarding-data-to-two-different/m-p/276031#M52951 <P>As part of the upgrade we are planning to deploy Splunk 6.3 on a new set of physical servers.<BR /> We have around 217 forwarders sending data in the existing infrastructure.<BR /> Can we have the forwarders configured to send data to the existing infrastructure as well as the new 6.3 enterprise cluster?</P> <P>The thought behind this is to have existing infrastructure intact while we upgrade the new infrastructure.</P> Wed, 09 Dec 2015 23:27:07 GMT https://community.splunk.com/t5/Getting-Data-In/Can-we-have-the-same-source-forwarding-data-to-two-different/m-p/276031#M52951 athorat 2015-12-09T23:27:07Z https://community.splunk.com/t5/Getting-Data-In/Can-we-have-the-same-source-forwarding-data-to-two-different/m-p/276032#M52952 <P>Hi athorat,</P> <P>yes, this can be configured in <CODE>outputs.conf</CODE></P> <PRE><CODE># Clone events to groups indexer1 and indexer2. [tcpout:indexer1] server=Y.Y.Y.Y:9997 [tcpout:indexer2] server=X.X.X.X:9997 </CODE></PRE> <P>Hope this help ...</P> <P>cheers, MuS</P> Wed, 09 Dec 2015 23:50:40 GMT https://community.splunk.com/t5/Getting-Data-In/Can-we-have-the-same-source-forwarding-data-to-two-different/m-p/276032#M52952 MuS 2015-12-09T23:50:40Z