I had tried to set the configuration from all the question that have been asked at the Splunk answers, in my experiments by using props and transforms it's only reroute the data into another index. So it's like replacing the existing index that we already set up in inputs.conf. Here's my example : inputs.conf: [script://./bin/top.sh] interval = 60 sourcetype = top source = top index = os disabled = 0 Props.conf [top] TRANSFORMS-duplicate1 = replicate1, replicate2 Transforms.conf [replicate1] REGEX = . DEST_KEY = _MetaData:Index FORMAT = os [replicate2] REGEX = . DEST_KEY = _MetaData:Index FORMAT = test2 So what i want to do here is to replicate the exact same data into two different indexes without consuming license, any idea? ... View more

I need help for customizing the menu messages, activity, and help menu on Splunk 6.5+ The older version can be done by using application.css and put it at /etc/apps//appserver/static/application.css. And call the application.css in dashboard xml with stylesheet=application.css. But somehow this way of customizing is not working on Splunk 6.5+, anybody can help with this kind of customization? Appreciate it. ... View more