How can I purposely duplicate events to multiple indexes?

[juniormint]

I realize this will incur twice the license usage...but lets ignore that fact for a moment.

How can I get an event into two indexes?

My events are coming from a universal forwarder with a default index of "ABC" and source="XYZ".

On the indexer I have indexes "ABC" and "DEF".

What I would like is to send all source XYZ events to the ABC index and a subset to DEF.

[ShaneNewman · Accepted solution]

I have done this with the index and forward option, although I will say that I don't do it anymore. My preferred method now, is to create a summary index on a 3 minute delay to send the filtered events to the other index. This means that we don't have to worry about the license issue.

Is there a reason why this is not acceptable for you? You can stream the _raw to your summary...

[ShaneNewman]

What I have show above mimics index and forward, it is just less cumbersome and makes it easier to change. Changes using this method also do not require a restart of the instance either, just a reload of the EAI Objects.

[juniormint]

http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Routeandfilterdatad#Route_inputs_to_speci...

I think the index and forward option is what is shown on this page

[juniormint]

That is great and would work for my stated problem...I think. What is the index and forward option?

[ShaneNewman]

This would go into a savedsearches.conf file.

[ShaneNewman]

For the summary index option:

[_some_search_name]
action.summary_index = 1
action.summary_index._name = DEF
action.summary_index.stat_tag = #Treat this as sourcetype#
cron_schedule = */1 * * * *
dispatch.earliest_time = -3m@m
dispatch.latest_time = -2m@m
enableSched = 1
realtime_schedule = 0
search = index=ABC sourcetype=your_sourcetype (add an additional search field to filter the results you want to send)

You can preform a sistats at the end if you want, although it is not needed if you just want the raw events.

[juniormint]

I'm interested in both approaches..can you point me at relevant doc pages? or provide an example?