Splunk duplicate logs isn't working

[splunky1]

I have the following inputs.conf in the UF for Splunk_TA_windows.

My intension is to send a copy of logs into two different indexers, I am aware of license re-use but I am ok with that. With the below config some logs are going to one index and other logs are going to other index.

When I compare the logs in index wineventlog and testsys they are not identical, the logs that I see in wineventlog are different and testsys are different. Looks like some are pushed to one index while other are pushed to 

###### Windows OS Logs ##############

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = testsys
renderXml = false

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml = false

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
index = testsys
renderXml = false

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
index = wineventlog
renderXml = false

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = testsys
renderXml = false

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml = false

[WinEventLog://Microsoft-Windows-DriverFrameworks-UserMode/Operational]
disabled = 0

[gcusello]

Hi @splunky1,

Splunk doens't index twice the same log so the solution you tried doesn't work.

If you want to send some logs to two indexes (with double license consuption!) you have to follow the steps described at https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Route_inputs_to_s... 

ùIn few words, you have to insert in outputs.conf two destinations 

[tcpout:systemGroup]
server=server1:9997

[tcpout:applicationGroup]
server=server2:9997

and in inputs.conf say which logs must be sent to only one or both the indexes:

[monitor://.../file1.log]
_TCP_ROUTING = systemGroup

[monitor://.../file2.log]
_TCP_ROUTING = applicationGroup

Ciao.

Giuseppe