Getting Data In

Any way to send events to two indexes (on the same indexer cluster) simultaneously ?

robgarner
Path Finder

Hi -

I briefly need to ensure that events from one UF (multiple sources) are duplicated in two indexes on one index cluster (developmentmumbledashboardupdatesetc).

I can't find any references in the docs; looks like most people want to know how to NOT duplicate events.

Anyone done this ?  Got advice for how to proceed ?

Thanks,

-Rob

 

Labels (1)
0 Karma

PickleRick
Ultra Champion

That seems kinda counter-productive. If your data is indexed twice, you'll use up your license twice for those events.

You could forward a copy of an event from HF to another HF (something based on https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Replicate_a_subset... ) and try to rewrite the destination index there but I'm not sure it would work at all. Just a guess.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I think that you could copy data with props and transform and change index of another feed. Unfortunately I haven’t example in my hand, but I have seen quite similar case in one of my clients environment.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...