Getting Data In

How to indexing data into two different indexes from one single log source without consuming Splunk License?

kangriawan
Explorer

I had tried to set the configuration from all the question that have been asked at the Splunk answers, in my experiments by using props and transforms it's only reroute the data into another index. So it's like replacing the existing index that we already set up in inputs.conf.

Here's my example :

inputs.conf:
[script://./bin/top.sh]
interval = 60
sourcetype = top
source = top
index = os
disabled = 0

Props.conf
[top]
TRANSFORMS-duplicate1 = replicate1, replicate2

Transforms.conf
[replicate1]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = os

[replicate2]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = test2

So what i want to do here is to replicate the exact same data into two different indexes without consuming license, any idea?

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi kangriawan,

There is a license meter at the end of the parsing phase, and any _raw data is metered for license usage before they are compressed and written to disk. So, if you want to keep duplicate _raw events in both indexes, there is no way you can consume license for data in just one index.

Duplicating data after they are indexed does not consume license. Actually, if you want to keep more than one copy of the data, why don't you deploy an indexer cluster to keep several copies of indexed data? Set the replication factor and the specified copies of indexed data will be replicated across the cluster without consuming additional license.

For details, please refer to the docs:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Aboutclusters

Hope this helps. Thanks!
Hunter

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...