Can i use outputs.conf to send some data to one splunk environment and other data to another splunk environment?

[smcdonald20]

I work for a managed service provider.
We use Splunk to monitor servers for our clients.
One of our clients has built their own splunk instance, and wants us to forward their app log data (which we don't currently ingest) to their splunk instance.

I know that i can send data to 2 splunk environments, but my question is can i choose which data goes to which environment?
i.e. we don't want to send their log data to our environment as we are only interested in perfmon, wineventlog etc.

Thanks

[scannon4]

We have some UFs that send data to our Splunk and then some data to another Splunk instance internally for a different team. We push an inputs.conf and an outputs.conf to do it. Index name needs to be same on both instances (at least that is what I do). Samples below:

inputs.conf
[WinEventLog://Security]
_TCP_ROUTING = server2.foo.com
disabled = 0
index = winseclog

outputs.conf
[tcpout:group1]
autoLBFrequency = 30
forceTimebasedAutoLB = true
useACK=true

[tcpout]
defaultGroup = group1
forwardedindex.0.whitelist = .*
indexAndForward = 0

[tcpout:server2.foo.com]
maxQueueSize = 10MB
server = server2.foo.com:9997

[gjanders]

Refer to routing and filtering data

In particular the section "Route inputs to specific indexers based on the data input" may be your best option...the document explains what to do