Any way to send events to two indexes (on the same indexer cluster) simultaneously ?

[robgarner]

Hi -

I briefly need to ensure that events from one UF (multiple sources) are duplicated in two indexes on one index cluster (developmentmumbledashboardupdatesetc).

I can't find any references in the docs; looks like most people want to know how to NOT duplicate events.

Anyone done this ?  Got advice for how to proceed ?

Thanks,

-Rob

[PickleRick]

That seems kinda counter-productive. If your data is indexed twice, you'll use up your license twice for those events.

You could forward a copy of an event from HF to another HF (something based on https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Replicate_a_subset... ) and try to rewrite the destination index there but I'm not sure it would work at all. Just a guess.

[isoutamo]

I think that you could copy data with props and transform and change index of another feed. Unfortunately I haven’t example in my hand, but I have seen quite similar case in one of my clients environment.

r. Ismo