How can I send the same data to multiple indexers?

[daniel333]

All, 

I am in a transition state moving from one instance of Splunk to another. The old instance needs to stay up for a while, but I'd like to start shipping a certain subset of data (one sourcetype) to the new stack as well. 

Is there a way to get a universal forwarder to send all data to two separate indexers? 

[burwell]

Hi Daniel!

Splunk calls this data cloning

 https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Configureforwardingwithoutputs.conf...

Use outputs.conf like this:

[tcpout]
defaultGroup=cloned_group1,cloned_group2

[tcpout:cloned_group1]
server=10.10.10.1:9997, 10.10.10.2:9997, 10.10.10.3:9997

[tcpout:cloned_group2]
server=10.1.1.197:9997, 10.1.1.198:9997, 10.1.1.199:9997, 10.1.1.200:9997