we are in a setup process of a local development environmet (with pushing to a git server and so on).
One question arise:
If I setup my local Splunk installation as a Search Head, I can utitilize the production data for development.
But, how to prevent running (and executing) some crucial commands like collect, and creating form my "DEV-SearchHead" data to the production index.
You should be very careful if connecting a non-prod SH to production indexer/s. Not only can commands like |delete and |collect cause problems but its also very easy to accidentally add apps to your dev environment that create a ton of load on your prod indexers. I have seen time and time again customers adding apps with Report Accelerations and Data Model Accelerations to Dev which cause a huge amount of load on the production environment.
If you are careful you can do what you want. However its typically safest to keep the environments totally seperate and just manually export data from prod to dev when you need to do things.