Getting Data In

How to send same data source to two or multiple indexes

arunsunny
Path Finder

Consider I have to monitor below log file and send to two or multiple indexes at the same time. ( NOTE: Not indexers groups)

[monitor://D:\test\test1.log]
sourcetype = test
index = online and offline

How can we achieve this?

woodcock
Esteemed Legend

Another option to avoid double-license hit is to schedule a saved search to use the collect command to copy all the events from the original index into a summary index.

gcusello
SplunkTrust
SplunkTrust

Hi arunsunny,
I don't know why do you want to send the same logs to different indexes, but remember that in this way you have a double (or more) license consumption!
Anyway if you want to do this, the only way is to create symbolic links ( http://docs.splunk.com/Documentation/Splunk/6.6.3/admin/Inputsconf ) and index both original file and symbolic link.
Bye.
Giuseppe

arunsunny
Path Finder

Hi Cusello,

Could you please provide me an example for the above-mentioned scenario to achieve using a symbolic link.

Regards,
Arun

0 Karma

woodcock
Esteemed Legend

Like this:

[monitor://D:\test\test1.log]
sourcetype = test
index = online

[monitor://D:\linktotest\test1.log]
sourcetype = test
index = offline

The create s symbolic link from linktotest to test:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa363878(v=vs.85).aspx

arunsunny
Path Finder

Thank you, Woodcock !!

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...