Hi @PickleRick , Thanks for Replying. Organization is currently sending logs to say to Indexer1 which has indexes with name say abc_index. Now they have a completely separate Splunk environment as well where they have indexer2 which has index name say xyz_index. They want to send the logs to xyz_index as well and that by having an intermediate forwarder (HF) between UF and indexer2 (So from UF>HF>Indx2). Now they want to dual feed the logs to indexer1 (in index abc_index) and indexer2 (in index xyz_index). Eventually they going to get rid of indexer1 but for now they want dual feed. I guess it is more close to this problem. Can I override an index name at indexer? - Splunk Community The only difference is in that case logs are splitting from HF and in my case it is from UF. you have replied there as well but finding it hard to implement.  Thanks ... View more

Hi @gcusello , Thanks for answering. So, the requirement is that same index should not be present in both the indexers by that I meant that if I want to index the data in index1 in first indexer then the data must be in index2 in another indexer.  We don't want same index name on both indexers. So, I guess (I am not sure) to override index we need to have the index first where the data would be ingested and then we override index so that it takes the metadata of the previous index. Requirement is to send logs to first indexer with index name index1 and send same logs to another indexer in index2 and we don't want index1 at all on the second indexer. Thanks ... View more