Splunk Enterprise

Are there any additional storage or performance considerations before pursuing overhead with splitting indexes?

New Member

We currently have a multi-tier Splunk Enterprise instance with search-head clustering and indexer clustering.

All of our data comes in from Universal Forwarders on remote VMs (thousands of them) from different customers.

Our inputs.conf on all of the forwarders are set to send to only a couple of indexes in our indexer cluster.


We are planning a project to split these indexes on a per-customer basis.

For example, index "main" would become "main-cust1", "main-cust2", etc.


The point behind this is to allow RBAC on a per-customer basis (by limited access to customer specific indexes).


Are there any additional storage or performance considerations that should be evaluated before pursuing this change?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...