Getting Data In

How to split event to two indexes?

Path Finder

I would like to know if it is possible to be able to inject an event to a heavy forwarder via the hec and then have it be split into two events and sent to different indexes.

For example I have the original log line of:

ID=1 time=”2022-12-29 16:57:41 UTC” name=”person” address=”abc” message=”some note”.

I want the event to be split but the two new events can share similar fields.

So index1 would be:  

ID=1 time=”2022-12-29 16:57:41 UTC” name=”person” address=”abc”

And index2 would be:

ID=1 time=”2022-12-29 16:57:41 UTC” message=”some note”

Labels (3)
Tags (2)
0 Karma


I believe it can be done.  Use the CLONE_SOURCETYPE setting in transforms.conf to create a copy of the event and give it a new sourcetype.   Then each sourcetype should be able to use REGEX and FORMAT settings to select the fields they want.

You'd think that the new Ingest Actions feature would be perfect for this, but it does not offer the type of changes you want to make.

This would be easier using Cribl (

Either way, duplicating the events means doubling your ingest, with corresponding effects on your license and storage.

If this reply helps you, Karma would be appreciated.
0 Karma

Path Finder

thanks. doubling my ingest doesn't sound like a great idea. It would be cheaper to send two requests.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...