Single Index v/s Multiple Indexes

[AnmolKohli]

We are moving from on-prem to cloud in splunk and as a part of this would want to know the index strategy that should be used?
We currently have different indexes for each application/service(200 indexes in total which would increase to 500 in next 2 years). What are the disadvantages and advantages of using multiple indexes as compared to single index and vice-versa? Would the queries be slow if we use a single index with multiple sourcetypes?i

[tiagofbmm]

Well the answer is yes.

Adding to the security layer that having indexes enforces by using roles and their allowed to search list of indexes, splunk searches also gain from having separate indexes. The main reason is if you are searching an index that has a high number of sourcetypes and your search spreads through a specific time range, then Splunk would have to gzip more slices of data to check whether the data your are asking for is there or not.
If you are searching one index only, then even if you are searching in more than one bucket, at least you know that you are being more precise.

More, you can specify retention policies per index, not per sourcetype, so it eases up your life having them separated.

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that