Hi -
I briefly need to ensure that events from one UF (multiple sources) are duplicated in two indexes on one index cluster (developmentmumbledashboardupdatesetc).
I can't find any references in the docs; looks like most people want to know how to NOT duplicate events.
Anyone done this ? Got advice for how to proceed ?
Thanks,
-Rob
That seems kinda counter-productive. If your data is indexed twice, you'll use up your license twice for those events.
You could forward a copy of an event from HF to another HF (something based on https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Replicate_a_subset... ) and try to rewrite the destination index there but I'm not sure it would work at all. Just a guess.
I think that you could copy data with props and transform and change index of another feed. Unfortunately I haven’t example in my hand, but I have seen quite similar case in one of my clients environment.
r. Ismo