I need to send some logfiles twice - send one set to my prod system, and another to a dev system. I have two different inputs/outputs in their own apps to handle the processing. Will Splunk do this, or will it determine that the logfiles are already being processed and only read them once?
The complex one is :
in outputs.conf : to define 2 tcpout groups,
in inputs.conf : create symlinks to the file, add an extra monitor on the symlink, add crcSALT to avoid conflict.
then and use _TCP_ROUTING rules on inputs.conf
the risk is that if one group is blocked, both will be blocked.