With Splunk App for Unix and Linux, it's is possible to state what indexes will be used.
However is it possible to configure a splunk server that could connect to a number of environments dev,test,live each with the app on but using the splunkforwarder to send it to the central splunk but each of the environments use its own index.
Yes, however it might require you to edit some views.
You should take a look at macros.conf to specify your indexes.
example;
[all-indexes]
definition = index=dev OR index=test OR index=live
[dev-index]
definition = index=dev
Call the macros using all-indexes
in savessearches.conf and edit the views that might contain hard-references to the "default" os index / search, grep for index=os .
Thats sounds like it should work 🙂
So for Splunk App for Unix and Linux
edit the macros.conf on the server
change it to the following
[os_index]
definition = index=dev OR index=test OR index=live
Create a dev,test and live index on the server
The rest of the macros.conf then uses 'os_index'
Then edit the inputs.conf on the forwarder for each environment thus Development will send it to the dev index.
Now for the icing on the cake, set a role called dev with only access to the Dev index. Lets see if this will work.