When you compare installing an app, to indexing everything in "main", it seems like you are overlooking some of the primary reasons for apps and indexes.
Apps provide a way to package and distribute configurations such as field extractions, views, lookups, custom commands, and other functionalities in an organized way. Some apps expect to find data in specific indexes by default and some don't. If you want to use a functionality like dbconnect, look at a good collection of dashboard examples, connect splunk to active directory or hundreds of other things outside of splunk's core functionality, doing so without the benefit of others' work through apps would be a daunting proposition.
Generally, separate indexes provide a way to apply different access and retention polices to different types of data, and can improve performance in various ways depending on how you search and how much data is getting written to your index(es).
In short, the questions of whether or not to make use of apps, and whether or not to put all of your data into your "main" index are separate and have different considerations.
... View more