I want to duplicate a certain set of sourcetypes to a second index
etc_cribl
Posts: 14 mod
I want to duplicate a certain set of sourcetypes to a second index (for reasons). I'm typically processesing data through a pipeline and adding my index to the data and then sending off to Splunk via HEC. What's the best way to do this? Do I just need a second route, with a duplicate pipeline configured that then set a different index?
0
Answers
-
Clone function and add the meta index there
0 -
ah! I didn't even think of checking for a function, thanks!
0
