Can you suggest a best approach for Splunk Data On boarding and data segregation?

[rohitvjoshi]

Let us say we are getting data from 2 different sources called A and B. The data is coming under the index called "Example". A user wants to segregate the data for both A an B sources and data is forwarded from multiple servers. Is there a different approach we can follow or that you can recommend?

[DalJeanis · Accepted solution]

Your options are (1) override the sourcetype and/or index based on source (2) filter the searches based on source.

The approach to recommend depends on what you mean by "segregate". If your client wants certain people to only be able to see certain parts of the data, and needs to be absolutely certain of that fact -- certain enough to satisfy a savvy auditor -- then the ONLY method to recommend is to split them into different indexes.

On the other hand, if it's more of a convenience thing, then a search macro filtering based on source may be sufficient for the need.