Getting Data In

Any way to send events to two indexes (on the same indexer cluster) simultaneously ?

robgarner
Path Finder

Hi -

I briefly need to ensure that events from one UF (multiple sources) are duplicated in two indexes on one index cluster (developmentmumbledashboardupdatesetc).

I can't find any references in the docs; looks like most people want to know how to NOT duplicate events.

Anyone done this ?  Got advice for how to proceed ?

Thanks,

-Rob

 

Labels (1)
0 Karma

PickleRick
Champion

That seems kinda counter-productive. If your data is indexed twice, you'll use up your license twice for those events.

You could forward a copy of an event from HF to another HF (something based on https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Replicate_a_subset... ) and try to rewrite the destination index there but I'm not sure it would work at all. Just a guess.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I think that you could copy data with props and transform and change index of another feed. Unfortunately I haven’t example in my hand, but I have seen quite similar case in one of my clients environment.

r. Ismo

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!