How to direct certain sourcetypes into a non-default index

[Alan_Bradley]

When I've created a new index. how can I direct certain sourcetypes to be indexed in that new index, rather than into main?

Likewise, is it possible to have one or more sourcetypes indexed into multiple indexes simultaneously? The use case for this would be if you had two roles who were allowed to see only indexA and indexB, respectively, but there were some small amount of data that each needed to see in common.

[gkanapathy · Accepted solution]

It is easy to direct inputs to indexes by specifying an index clause where the input is defined. To direct by sourcetype, you must route using an index-time transform against MetaData:Sourcetype, and must furthermore make sure that your transform runs only after the sourcetype is set. In most cases, it's just as easy to set the index when you set the sourcetype anyway.

I would recommend you simply set up a third index for the overlap rather than trying to index data twice. There's not really a good way to do it, other than trickery involving forwarding the data to different ports on the same indexers or something along those lines.