In a Splunk Enterprise instance, will configuring a universal forwarder to clone all event logs to two indexers result in double the license usage?
The intent is for all events to be mirrored in two separate indexes.
Yes, it will increase your ingestion license consumption. The indexers don't know the data is cloned so it's not treated specially.
Thanks.
Is there a way to accomplish the same intent without increasing license consumption? Such as utilizing a heavy forwarder to ingest the events, then send the data to two indexers?
What are you trying to accomplish by sending the same data to two indexes? Once we understand that we can offer suggestions.
