Getting Data In

How to send same data source to two or multiple indexes

arunsunny
Path Finder

Consider I have to monitor below log file and send to two or multiple indexes at the same time. ( NOTE: Not indexers groups)

[monitor://D:\test\test1.log]
sourcetype = test
index = online and offline

How can we achieve this?

woodcock
Esteemed Legend

Another option to avoid double-license hit is to schedule a saved search to use the collect command to copy all the events from the original index into a summary index.

gcusello
SplunkTrust
SplunkTrust

Hi arunsunny,
I don't know why do you want to send the same logs to different indexes, but remember that in this way you have a double (or more) license consumption!
Anyway if you want to do this, the only way is to create symbolic links ( http://docs.splunk.com/Documentation/Splunk/6.6.3/admin/Inputsconf ) and index both original file and symbolic link.
Bye.
Giuseppe

arunsunny
Path Finder

Hi Cusello,

Could you please provide me an example for the above-mentioned scenario to achieve using a symbolic link.

Regards,
Arun

0 Karma

woodcock
Esteemed Legend

Like this:

[monitor://D:\test\test1.log]
sourcetype = test
index = online

[monitor://D:\linktotest\test1.log]
sourcetype = test
index = offline

The create s symbolic link from linktotest to test:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa363878(v=vs.85).aspx

arunsunny
Path Finder

Thank you, Woodcock !!

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...