I am onboarding a new data source. I need to send all of the data to index 1 and part of data to index 2. Is it possible to implement this using transforms? I know it's possible to send particular data to index 1 and remaining to null queue. Could you please help me regarding this?
I believe you are looking for CLONE_SOURCETYPE
https://answers.splunk.com/answers/334586/how-to-index-the-same-set-of-logs-and-route-them-t.html
Hi DalJeanis,
Are the any examples, how to implement it. unable to determine the data flow . I tried to clone sourcetype on indexers
Look at the configuration in the question of following post, minus the setnull configs.