Is it possible to set up Windows Event Viewer forwarding from one server to multiple indexes?

[jmt0806]

Is it possible to set up Windows Event Viewer forwarding from one server to multiple Splunk indexes?

We're in a shared server environment, and another group has already setup forwarding for Event Viewer logs.

Prefer having separate copy of logs for ease of querying/control over config changes.

[muebel]

You can setup a WinEventLog input, and then create a scripted input set to a different index.

I'd advise not worrying about that, and just have both groups use the same index. The events in the index shouldn't be modified, just the searches that filter the events. So it's perfectly ok for two groups to look at the same data in different ways.