The simplest way would likely be to create three instances of the app (rename each directory and the contents of default/the app.conf ) and configure your three different accounts that way.
... View more
I believe your problem is that in order for the ES SH to be able to trigger the stream capture, it has to be the SH running the stream app that the forwarders are communicating with. At least, that is the impression I get from http://docs.splunk.com/Documentation/ES/4.7.4/Install/IntegrateSplunkStream
... View more
This is controlled by a setting under the "Threat Intelligence Download Settings" within ES. You can set the "Maximum age" for each threat intelligence feed so that data ages out once it is stale.
Hope this helps!
... View more