Can a single universal forwarder forward data to two different indexers?

[pavanae]

Hi

I am using a Universal Forwarder, say in Machine A. It has logs at one path, say Log Path1. Now I want this Forwarder to forward LogPath1 data to one indexer say "B" and to other indexer say "C".

Is this scenario possible? pls help.

[martin_mueller · Accepted solution]

You can choose between load balancing and data cloning: http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Configureforwarderswithoutputs.confd#De...

[bmacias84]

This is only available in with the heavy forwarders.

[acharlieh]

@bmacias84 While per event routing will only work in heavy forwarders / indexers, generic cloning using only inputs.conf and outputs.conf which deal with data sources as wholes will work in Universal forwarders as well. (you might even be able to do per-event routing if you have a data source using INDEXED_EXTRACTIONS on the UF as well :), but that's a big exceptional flow)

[martin_mueller]

I'm pretty sure a universal forwarder can do load balancing and data cloning.