Getting Data In

How to send same data source to two or multiple indexes

arunsunny
Path Finder

Consider I have to monitor below log file and send to two or multiple indexes at the same time. ( NOTE: Not indexers groups)

[monitor://D:\test\test1.log]
sourcetype = test
index = online and offline

How can we achieve this?

woodcock
Esteemed Legend

Another option to avoid double-license hit is to schedule a saved search to use the collect command to copy all the events from the original index into a summary index.

gcusello
Legend

Hi arunsunny,
I don't know why do you want to send the same logs to different indexes, but remember that in this way you have a double (or more) license consumption!
Anyway if you want to do this, the only way is to create symbolic links ( http://docs.splunk.com/Documentation/Splunk/6.6.3/admin/Inputsconf ) and index both original file and symbolic link.
Bye.
Giuseppe

arunsunny
Path Finder

Hi Cusello,

Could you please provide me an example for the above-mentioned scenario to achieve using a symbolic link.

Regards,
Arun

0 Karma

woodcock
Esteemed Legend

Like this:

[monitor://D:\test\test1.log]
sourcetype = test
index = online

[monitor://D:\linktotest\test1.log]
sourcetype = test
index = offline

The create s symbolic link from linktotest to test:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa363878(v=vs.85).aspx

0 Karma

arunsunny
Path Finder

Thank you, Woodcock !!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!