We have three different instances of Qualys to gather data from. This will require the app be installed on three different Forwarders to provide the credentials for three different connections. There is no security need to separate the data on the Splunk indexers to three different indexes. Can we change the sourcetype for each instance to add like _instance1 to the end in order to separate the data between the three inputs while still putting it all in one index? This would require some code modification on the reports and searches as well to look for the new sourcetype names. Just don't want to have three indexes setup for this if we can modify the sourcetype names to do the same thing.
