Can you group configuration files to simplify each app in Splunk (search head, indexer, forwarder)?

[deodion]

Is there any guideline or best practice what .conf to put in gui/indexer/forwarder level?

I mean each .conf has its purpose and a lot of settings, but maybe in practice we can somehow isolate its complexity by grouping the .conf for each level?

Or at least minimize complexity.

Like for example, forwarder usually boils down to at minimum app.conf, inputs.conf, outputs.conf

[gcusello]

Hi deodion,
I usually use one TA for outputs.conf and many TAs for different inputs.conf.
Bye.
Giuseppe