How to forward log files to two different servers?

[a212830]

Hi,

I need to send some logfiles twice - send one set to my prod system, and another to a dev system. I have two different inputs/outputs in their own apps to handle the processing. Will Splunk do this, or will it determine that the logfiles are already being processed and only read them once?

[rmorlen]

You could setup two instances of the splunk forwarder on the same box. One sends to prod, one sends to dev.

If you want all the logs to go to both you could also setup index and forward on the indexers and forward the data.

[yannK]

2 forwarders is the easy method. very reliable.

The complex one is :
in outputs.conf : to define 2 tcpout groups,
in inputs.conf : create symlinks to the file, add an extra monitor on the symlink, add crcSALT to avoid conflict.
then and use _TCP_ROUTING rules on inputs.conf
the risk is that if one group is blocked, both will be blocked.