To answer your question... Yes, it is possible. This is the documentation you require: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Route\_specific\_events\_to\_a\_different_index
You would have to modify your REGEX statement in your transforms.conf to grab the events you require:
[<transforms_A>]
REGEX = EventCode:([0-9]{1,3}|1000)
DEST_KEY = _MetaData:Index
FORMAT = indexA
[<transforms_B>]
REGEX = EventCode:1(0[0-9]{3}|1000)
DEST_KEY = _MetaData:Index
FORMAT = indexB
You might have to play around with the regex statements provided in example
... View more