If I have 2 identical inputs.conf monitor stanzas except for the target indexes, will data be received in both indexes or only the first?

[mmensch]

Hello,

I just had a quick question about the inputs.conf file in the Splunk Universal Forwarders.

Let's say, I have these two stanzas in my inputs.conf file:

[monitor:/usr/output.log]
_TCP_ROUTING = *
index = index1
sourcetype = user_logs

[monitor:/usr/output.log]
_TCP_ROUTING = *
index = index2
sourcetype = user_logs

I am curious if data will be received in both indexes, or if the data will only go to the first index?

Thanks,
Matt

[lguinn2]

You might also want to read the Configuration File Precedence section of the Administration manual to understand how it works. The rules aren't difficult and it will really help you as a Splunk administrator to understand how they work.

As @woodcock points out, btool is a great way to look out the results of the precedence rule operation.

[woodcock · Accepted solution]

The data will go to the first index. There are many rules that cover precedence but if everything is identical, the first one will take precedence over the second one. To see what Splunk thinks is being used, run this:

$SPLUNK_HOME/splunk cmd btool inputs list --debug