I want to duplicate a certain set of sourcetypes to a second index

etc_cribl

I want to duplicate a certain set of sourcetypes to a second index (for reasons). I'm typically processesing data through a pipeline and adding my index to the data and then sending off to Splunk via HEC. What's the best way to do this? Do I just need a second route, with a duplicate pipeline configured that then set a different index?

David Maislin

Clone function and add the meta index there

etc_cribl

ah! I didn't even think of checking for a function, thanks!