I've a setup where,
Couple of options thought of,
Have separate splunk installation/environment for each client such that the index name mobile (hence the associated dashboards , reports) can be reused...additional cost of hardware and copy (thus maintenance) of application code, but easiest option
I need some pointers on above and also any other option that you can share.
Any pointers would be greatly appreciated.
The best way would be to have separate indexes per client. Create a Splunk role for each client and set their index visibility accordingly, and make sure they don't inherit the "all non-internal indexes" from the default user role.
Have your dashboards load data for
index=client_*. That way each user will load all the client indexes he can read, which is only the one you set in their role. No huge work on the dashboard/report code necessary.
Separate environments will work as well, but is a lot of effort if you don't need the additional hardware for indexing/search volume anyway.
One other way you can consider (but which is not completely secure -- a clever user with the right access could get around it) is to use the role filters. Set up roles for each client X, then set up roles with the filter
client_id=X for each client.
Separate indexes will be more secure, but role filters will work similarly in most cases.