Getting Data In

index the same logs to multiple indexes - good or bad?

dwin02
Explorer

Hi There,
I would like to know if it's not recommended to index the same logs to two different indexes?

We actually found a way to do it using a symlink :
https://answers.splunk.com/answers/61433/have-forwarder-duplicating-data-to-2-indexes.html

Besides the license usage since we will be indexing the same logs twice, is this a bad practice?

Thanks,
Aldwin

1 Solution

woodcock
Esteemed Legend

I think that it is a terrible idea. First, it is a double-license hit ($$). Second, it is a double-disk hit ($) with negligible added value. Usually when people are considering this it is because they are starting to think HA and DR. Splunk has tools for this in the multi-site and clustering configurations. That is the route that you should examine first (they are not perfectly flexible but can usually be made to work).

View solution in original post

0 Karma

dwin02
Explorer

Thank you both for your answers.

Much appreciated!!!

0 Karma

woodcock
Esteemed Legend

I think that it is a terrible idea. First, it is a double-license hit ($$). Second, it is a double-disk hit ($) with negligible added value. Usually when people are considering this it is because they are starting to think HA and DR. Splunk has tools for this in the multi-site and clustering configurations. That is the route that you should examine first (they are not perfectly flexible but can usually be made to work).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I vote 'bad'. In addition to doubling your license usage, your searches will have duplicate results.
If you want to protect your data from an indexer failure, use index replication. It achieves the same result without affecting your license or search results. See http://docs.splunk.com/Documentation/Splunk/6.6.2/Capacity/ComponentsofaSplunkEnterprisedeployment#I....

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...