Building on this solid answer, I will point out that the nonprod data is still production for someone's job function. I would encourage you to challenge the separation and instead consider having one Splunk environment for all of the prod and nonprod. You can separate the data itself with indexes.
This will allow comparisons of data and patterns across the environments that are the bedrock Splunk's value.
You're welcome to share back any ideas you felt separation was appropriate. Maybe you notice something I didn't consider OR maybe you will learn cool product features you didn't know.
Remember that a lab is not the same as non-prod. See Lab environment best practices for a Splunk deployment
... View more