We currently have a multi-tier Splunk Enterprise instance with search-head clustering and indexer clustering.
All of our data comes in from Universal Forwarders on remote VMs (thousands of them) from different customers.
Our inputs.conf on all of the forwarders are set to send to only a couple of indexes in our indexer cluster.
We are planning a project to split these indexes on a per-customer basis.
For example, index "main" would become "main-cust1", "main-cust2", etc.
The point behind this is to allow RBAC on a per-customer basis (by limited access to customer specific indexes).
Are there any additional storage or performance considerations that should be evaluated before pursuing this change?
