Splunk Enterprise

How to store 2 versions of an event into different indexes coming in on a TCP port?

New Member


I am working on a data stream coming into Splunk via a TCP port input, and have the requirement to store two versions of the data into two different indexes. One version will be exactly as it comes in, and the other version will have sensitive data masked before it is indexed.

I know how to do the data masking itself, and I know how to change index name at index time, but I can't seem to figure out how to put these two things together to be able to do what I need to do.

Does anyone out there know how to do this?

Thank you!

0 Karma


Hi Eric,

Did you read the docs about Data Cloning with Heavy Forwarders ? Don't know if this works, but did you try something like this ?

index = index1
sourcetype = original
disabled = 0

index = index2
sourcetype = parse_me
disabled = 0


0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...