How to configure a universal forwarder to clone data to two different indexes?

[echalex]

Hello,

We have a setup where we share some data with our partner, so we have set up two different groups in outputs.conf, call them ourGroup and theirGroup. Then in inputs.conf, we set the _TCP_ROUTING to send to both groups. So far, so good.

Now it transpires that our partner would prefer a different naming convention for the index. I've looked at props.conf and transforms.conf, but it doesn't seem possible to change the index name, based on the tcpout-group. I'm not even sure if this is available on the UF.

So option 1 is to have multiple stanzas in inputs.conf for each source, with a different _TCP_ROUTING in each stanza. So, will there be a performance hit on the host with the UF installed? Especially interested in the Windows event log facility and how this would cope with several input stanzas.

Option 2, I guess, is to implement this in the receiving indexers. Whether I want to do this, I'm not completely sure. It would probably have to be our indexers. Our partner would have to implement several stanzas in props.conf, based on the host.

[gfuente · Accepted solution]

Hello

Option 1 won't work, you can't have multiple inputs to the same path, it will use only one of them.

The second option is the right one, leave the input without index configuration. And in the indexers use transforms to modify the index dynamically based on the sourcetype. See:

http://answers.splunk.com/answers/8531/routing-to-index-based-on-host-etc.html

Regards

[echalex]

Thanks! I guessed as much. An additional implied, but not articulated, question was: is there any way of doing this on the Universal Forwarder (using single stanzas)?