I want to duplicate a certain set of sourcetypes to a second index (for reasons). I'm typically processesing data through a pipeline and adding my index to the data and then sending off to Splunk via HEC. What's the best way to do this? Do I just need a second route, with a duplicate pipeline configured that then set a different index?
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.