I have a requirement of sending the same data from the SplunkForwarder agents to 2 different Splunk enterprise platforms to 2 different index.
Platform 1-- index1
Platform 2 -- index2
I need 2 different solutions
how can we achieve this by changing the configs at SplunkForwarder agents only
how can we achieve this by changing the configs at intermediate forwarders only
If all Your Forwarders pass through Heavy Forwarders it's the same thing, otherwise you have to change configuration in HFs and in each Forwarder that don't pass through HFs.
You have to modify outputs.conf that I suggest to deploy using a Deployment Server (if you have many Forwarders).
Anyway you have to insert in your outputs.conf both the target Indexers, something like this
If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ...