https://community.splunk.com/t5/Getting-Data-In/How-to-get-rsyslog-data-going-to-two-Splunk-instances/m-p/457699#M79114 <P>Check out the section titled "Filter and route event data to target groups" in this link:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad">https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad</A></P> Mon, 08 Jul 2019 19:01:19 GMT kmorris_splunk 2019-07-08T19:01:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-rsyslog-data-going-to-two-Splunk-instances/m-p/457698#M79113 <P>I would like to know if it is possible to have the data that is coming from the rsyslog server into two Splunk instances. </P> <P>My rsyslog server is filtering all data and whatever does not get caught falls into a catch all. I would like that catch all data to go to the accpt environment. </P> <P>Do anyone know how I could achieve this? </P> Mon, 08 Jul 2019 18:47:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-rsyslog-data-going-to-two-Splunk-instances/m-p/457698#M79113 David888 2019-07-08T18:47:18Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-rsyslog-data-going-to-two-Splunk-instances/m-p/457699#M79114 <P>Check out the section titled "Filter and route event data to target groups" in this link:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad">https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad</A></P> Mon, 08 Jul 2019 19:01:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-rsyslog-data-going-to-two-Splunk-instances/m-p/457699#M79114 kmorris_splunk 2019-07-08T19:01:19Z