You can create 2 different output groups in outputs.conf but there are some important considerations/downsides, including: 1: You will take a license hit twice on this data. 2: Test the configurations for back-pressure problems. Depending on the version of Splunk and the settings that are in place, a blockage of one indexer tier can effect transmission of data to the unblocked indexer tier. ... View more