https://community.splunk.com/t5/Splunk-Search/Indexed-data-redirection/m-p/79213#M181706 <P>Ayn, Thanks for clarification. Is there a way to manipulate at indexer lever to have the data in two different indexes?<BR /> My usecase is to have a index with actual data and another with same data but masked values.</P> Wed, 02 Oct 2013 06:57:44 GMT soe_hlawin 2013-10-02T06:57:44Z https://community.splunk.com/t5/Splunk-Search/Indexed-data-redirection/m-p/79211#M181704 <P>I want to redirection the indexed data into separate index through transforms.conf</P> <OL> <LI>Post redirection, does the data available in both the indexes or only the new index?</LI> <LI>Does this redirection consume double the space which ulimately doulbes my licensing cost?</LI> </OL> Wed, 02 Oct 2013 01:42:32 GMT https://community.splunk.com/t5/Splunk-Search/Indexed-data-redirection/m-p/79211#M181704 soe_hlawin 2013-10-02T01:42:32Z https://community.splunk.com/t5/Splunk-Search/Indexed-data-redirection/m-p/79212#M181705 <P>The redirection is a pure redirection, i.e. the data will go to the index you've redirected it to only. So, because it's only going to one index, there's no impact on licensing as you're still indexing the same amount of data.</P> Wed, 02 Oct 2013 03:42:25 GMT https://community.splunk.com/t5/Splunk-Search/Indexed-data-redirection/m-p/79212#M181705 Ayn 2013-10-02T03:42:25Z https://community.splunk.com/t5/Splunk-Search/Indexed-data-redirection/m-p/79213#M181706 <P>Ayn, Thanks for clarification. Is there a way to manipulate at indexer lever to have the data in two different indexes?<BR /> My usecase is to have a index with actual data and another with same data but masked values.</P> Wed, 02 Oct 2013 06:57:44 GMT https://community.splunk.com/t5/Splunk-Search/Indexed-data-redirection/m-p/79213#M181706 soe_hlawin 2013-10-02T06:57:44Z