How to indexing data into two different indexes from one single log source without consuming Splunk License?

[kangriawan]

I had tried to set the configuration from all the question that have been asked at the Splunk answers, in my experiments by using props and transforms it's only reroute the data into another index. So it's like replacing the existing index that we already set up in inputs.conf.

Here's my example :

inputs.conf:
[script://./bin/top.sh]
interval = 60
sourcetype = top
source = top
index = os
disabled = 0

Props.conf
[top]
TRANSFORMS-duplicate1 = replicate1, replicate2

Transforms.conf
[replicate1]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = os

[replicate2]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = test2

So what i want to do here is to replicate the exact same data into two different indexes without consuming license, any idea?

[hunters_splunk]

Hi kangriawan,

There is a license meter at the end of the parsing phase, and any _raw data is metered for license usage before they are compressed and written to disk. So, if you want to keep duplicate _raw events in both indexes, there is no way you can consume license for data in just one index.

Duplicating data after they are indexed does not consume license. Actually, if you want to keep more than one copy of the data, why don't you deploy an indexer cluster to keep several copies of indexed data? Set the replication factor and the specified copies of indexed data will be replicated across the cluster without consuming additional license.

For details, please refer to the docs:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Aboutclusters

Hope this helps. Thanks!
Hunter