https://community.splunk.com/t5/Getting-Data-In/Cluster-indexes-conf-gt-inputs-conf-gt-App-gt-serverClass/m-p/612684#M106007 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/54774">@jcorcoran508</a>,</P><P>the choose to have the same or two different indexes for Production and not production, usually depends on two factors:</P><UL><LI>the data retention,</LI><LI>the access rights.</LI></UL><P>if the Non Prod data must be conserved for the same time of the Prod data and the people that have to access&nbsp; are the same you can use the same index, otherwise you need to use different indexes, usually two different indexes are used!</P><P>Also because using one index you have to add to your searches the filter Prod/nonProd.</P><P>About inputs.conf, you have to create two apps to deploy using two different ServerClasses in the Deployment Server: each app contains an inputs.conf with the correct index to send data.</P><P>Ciao.</P><P>Giuseppe</P> Mon, 12 Sep 2022 06:44:36 GMT gcusello 2022-09-12T06:44:36Z https://community.splunk.com/t5/Getting-Data-In/Cluster-indexes-conf-gt-inputs-conf-gt-App-gt-serverClass/m-p/612670#M106005 <P>I am creating an index - configured the inputs.conf file.</P> <P>I have two prod servers with app logs that have the same Linux path&nbsp;</P> <P>Additionally, I have two test servers (Non-Prod) both had the same linux log paths , but different from the prod servers.</P> <P>Besides hard coding the servers in the inputs.conf file how does the process determine what host to collect the log data from identical paths listed in the inputs.conf</P> <P>some questions:</P> <P>Can I use the same index with prod and non prod (best practice ?)</P> <P>So the inputs.conf has the index=x under the log stanza name&nbsp; , so that maps the inputs.conf file to collect the data and the data belongs to index=x.</P> <P>In the deployment I create a serverClass with all 4 servers (prod and non prod)</P> <P>and assign the server class to the App that has inputs.conf file.&nbsp;</P> <P>Should I be creating separate indexes (prod and non-prod) then create separate&nbsp; Apps (prod and non-prod)&nbsp; then create separate ServerClasses (prod and non prod) ?</P> <P>&nbsp;</P> Mon, 12 Sep 2022 11:56:07 GMT https://community.splunk.com/t5/Getting-Data-In/Cluster-indexes-conf-gt-inputs-conf-gt-App-gt-serverClass/m-p/612670#M106005 jcorcoran508 2022-09-12T11:56:07Z https://community.splunk.com/t5/Getting-Data-In/Cluster-indexes-conf-gt-inputs-conf-gt-App-gt-serverClass/m-p/612684#M106007 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/54774">@jcorcoran508</a>,</P><P>the choose to have the same or two different indexes for Production and not production, usually depends on two factors:</P><UL><LI>the data retention,</LI><LI>the access rights.</LI></UL><P>if the Non Prod data must be conserved for the same time of the Prod data and the people that have to access&nbsp; are the same you can use the same index, otherwise you need to use different indexes, usually two different indexes are used!</P><P>Also because using one index you have to add to your searches the filter Prod/nonProd.</P><P>About inputs.conf, you have to create two apps to deploy using two different ServerClasses in the Deployment Server: each app contains an inputs.conf with the correct index to send data.</P><P>Ciao.</P><P>Giuseppe</P> Mon, 12 Sep 2022 06:44:36 GMT https://community.splunk.com/t5/Getting-Data-In/Cluster-indexes-conf-gt-inputs-conf-gt-App-gt-serverClass/m-p/612684#M106007 gcusello 2022-09-12T06:44:36Z