Getting Data In
Highlighted

Is it possible to set up Windows Event Viewer forwarding from one server to multiple indexes?

New Member

Is it possible to set up Windows Event Viewer forwarding from one server to multiple Splunk indexes?

We're in a shared server environment, and another group has already setup forwarding for Event Viewer logs.

Prefer having separate copy of logs for ease of querying/control over config changes.

0 Karma
Highlighted

Re: Is it possible to set up Windows Event Viewer forwarding from one server to multiple indexes?

SplunkTrust
SplunkTrust

You can setup a WinEventLog input, and then create a scripted input set to a different index.

I'd advise not worrying about that, and just have both groups use the same index. The events in the index shouldn't be modified, just the searches that filter the events. So it's perfectly ok for two groups to look at the same data in different ways.

0 Karma