Getting Data In

possible to add multiple index names inside inputs.conf

jonathan_lam
Explorer

For a single monitor in inputs.conf, is it possible to add multiple index names?

index = index1, index2

Basically, I want the same log files available to two custom indexes.

Tags (2)
0 Karma

kdenton
Path Finder

Can you be more detailed about what you are trying to do with monitoring the log files and having them go to separate indexes vs one index. What function are you trying to accomplish.

There could be another way.

0 Karma

araitz
Splunk Employee
Splunk Employee

This is not possible.

0 Karma

jonathan_lam
Explorer

Hi and thank you. All I'm trying to do is monitor the same set of log files in a single entry in the inputs.conf file but assign it two index names. Perhaps there is a better way to do this other than creating a duplicate entry and assigning it the second index name.

Sorry if I'm not making too much sense as I'm a Splunk newbie!

0 Karma

araitz
Splunk Employee
Splunk Employee

No, you cannot route data to two different indexes via inputs.conf.

Damien_Dallimor
Ultra Champion

Are you trying to achieve a High Availability(HA) architecture with a Disaster Recovery(DR) position ?

Splunk Indexers can replicate raw data to secondary indexers in a mirrored cluster.

Links to docs

Also, Splunk Forwaders can load balance and data clone over multiple indexers.Check out the example configs in outputs.conf

Link to outputs.conf overview

0 Karma

kdenton
Path Finder

Can you explain what you are trying to accomplish here?

You can send the events to several indexes if you breakout the events types in separate stanzas as listed in this article. To my knowledge you can not send to several indexes the way you have listed.

http://docs.splunk.com/Documentation/Splunk/latest/admin/Setupmultipleindexes

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...