This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
Cloning is configured in the outputs.conf file on the forwarding server. You will set up a target group of receiving servers to which the forwarder will send all its data.
On the forwarding server, add the following to $SPLUNK_HOME/etc/bundles/local/outputs.conf:
[tcpout] heartbeatFrequency=10 maxQueueSize=10000 [tcpout:indexer1] server=10.1.1.197:9997 [tcpout:indexer2] server=10.1.1.200:9999
This configuration will send every event to both 10.1.1.197:9997 and 10.1.1.200:9999. Make sure you enable receiving on all the servers you are sending cloned data to.