I have two different Splunk applications on two different search heads. Right now those search heads are also indexers, but this might change in the future.
Anyway: I defined two groups in etc/system/local/outputs.conf, and referred to one or another using TCPROUTING in each monitor stanza in etc/system/local/inputs.conf. I also removed default stanza from outputs.conf, so that there are no default groups. Is this setup good enough for the purpose?
Another way you could do it is to stand up 2 different instances of Splunk, but I would only use this approach if at least one of your input types is compressed (e.g. *.gz, *zip, etc.) because the AQ is single-threaded and could use the help anyway.
Offhand (quickly not looking at the docs) that sounds right. Are you seeing problems with it?
Edit: wait actually you may want to set the default routing to a dummy group if you don't want events to go anywhere by default.