Getting Data In

index the same logs to multiple indexes - good or bad?

dwin02
Explorer

Hi There,
I would like to know if it's not recommended to index the same logs to two different indexes?

We actually found a way to do it using a symlink :
https://answers.splunk.com/answers/61433/have-forwarder-duplicating-data-to-2-indexes.html

Besides the license usage since we will be indexing the same logs twice, is this a bad practice?

Thanks,
Aldwin

1 Solution

woodcock
Esteemed Legend

I think that it is a terrible idea. First, it is a double-license hit ($$). Second, it is a double-disk hit ($) with negligible added value. Usually when people are considering this it is because they are starting to think HA and DR. Splunk has tools for this in the multi-site and clustering configurations. That is the route that you should examine first (they are not perfectly flexible but can usually be made to work).

View solution in original post

0 Karma

dwin02
Explorer

Thank you both for your answers.

Much appreciated!!!

0 Karma

woodcock
Esteemed Legend

I think that it is a terrible idea. First, it is a double-license hit ($$). Second, it is a double-disk hit ($) with negligible added value. Usually when people are considering this it is because they are starting to think HA and DR. Splunk has tools for this in the multi-site and clustering configurations. That is the route that you should examine first (they are not perfectly flexible but can usually be made to work).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I vote 'bad'. In addition to doubling your license usage, your searches will have duplicate results.
If you want to protect your data from an indexer failure, use index replication. It achieves the same result without affecting your license or search results. See http://docs.splunk.com/Documentation/Splunk/6.6.2/Capacity/ComponentsofaSplunkEnterprisedeployment#I....

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...