Hi community, I'm looking for advice on the most efficient and cost-effective way to replicate/forward logs from one Splunk Cloud Platform instance to a second Splunk Cloud Platform instance. My constraints and requirements: - I want to avoid using a Heavy Forwarder as an intermediary, since I'm trying to keep the architecture fully cloud-native and reduce infrastructure overhead. - Both source and destination are Splunk Cloud Platform deployments (not Splunk Enterprise). - I need the forwarding to be as close to real-time as possible. - I'd like to minimize additional AWS/third-party costs (e.g., avoid S3 as a middle layer if possible). I've been looking into two main options: 1. Ingest Actions + S3 bucket → AWS TA on the destination instance. 2. Ingest Processor with a SPL2 `branch` command sending directly to both instances (the second one via an HEC token). For option 2, I was planning to use a single HEC token on the destination instance with all target indexes listed in the `indexes` field, and let the pipeline control routing via `eval index=...`. Does that sound right? Has anyone implemented either of these approaches in production? What were the trade-offs you encountered in terms of latency, cost, reliability, and maintainability? Any advice or real-world experience is greatly appreciated! ... View more