Splunk Search

Indexed data redirection

soe_hlawin
Explorer

I want to redirection the indexed data into separate index through transforms.conf

  1. Post redirection, does the data available in both the indexes or only the new index?
  2. Does this redirection consume double the space which ulimately doulbes my licensing cost?
Tags (2)
0 Karma
1 Solution

Ayn
Legend

The redirection is a pure redirection, i.e. the data will go to the index you've redirected it to only. So, because it's only going to one index, there's no impact on licensing as you're still indexing the same amount of data.

View solution in original post

0 Karma

Ayn
Legend

The redirection is a pure redirection, i.e. the data will go to the index you've redirected it to only. So, because it's only going to one index, there's no impact on licensing as you're still indexing the same amount of data.

0 Karma

soe_hlawin
Explorer

Ayn, Thanks for clarification. Is there a way to manipulate at indexer lever to have the data in two different indexes?
My usecase is to have a index with actual data and another with same data but masked values.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Pro Tips for .conf26: How to Prep Like a Splunk Veteran

There’s no shortage of incredible content lined up for .conf26 in Denver, from deep-dive technical sessions ...