How to get rsyslog data going to two Splunk instances?

[David888]

I would like to know if it is possible to have the data that is coming from the rsyslog server into two Splunk instances.

My rsyslog server is filtering all data and whatever does not get caught falls into a catch all. I would like that catch all data to go to the accpt environment.

Do anyone know how I could achieve this?

[kmorris_splunk]

Check out the section titled "Filter and route event data to target groups" in this link:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad