Hi @rphillips_splk, While I know this is some time ago, I still find this very interesting! You used 2 different routing types here - so I need to ask if this also could be applied on 2 TCP (different) connections, so the cloned version could also be send as TCP and not syslog? Moreover - I'm in the situation, there will be an additional HF where you show the "syslog receiver" above, and the actual indexer - so basically route like this: UF -> HF (clone) -> IDX |-> HF -> IDX Can this be done as smooth as above? If so, how?
... View more