I work for a managed service provider.
We use Splunk to monitor servers for our clients.
One of our clients has built their own splunk instance, and wants us to forward their app log data (which we don't currently ingest) to their splunk instance.
I know that i can send data to 2 splunk environments, but my question is can i choose which data goes to which environment?
i.e. we don't want to send their log data to our environment as we are only interested in perfmon, wineventlog etc.
We have some UFs that send data to our Splunk and then some data to another Splunk instance internally for a different team. We push an inputs.conf and an outputs.conf to do it. Index name needs to be same on both instances (at least that is what I do). Samples below: