Can UF send data to multiple indexes


I am using Splunk forwarder (not HEC) and want to know if I can send data to multiple indexes.
If yes, how?

Tags (1)
0 Karma

Esteemed Legend

Using HEC, it is really easy (because you do not need to fight the fishbucket), just do multiple post calls. Is this not working for you?

0 Karma


Are you trying to index same data in multiple indexes?

0 Karma


you can send data to multiple indexers.
In order to do it, you have setup the outputs.conf like the sample below and deploy this file to your UF clients using the deployment server.

defaultGroup = indexers

server =,,

For further information, please check this document ->

0 Karma