Hi @vp, are you speaking of Splunk Enterprise or Enterprise Security or ITSI? because ES and ITSI aren't multitenant. Anyway you can create a different set of alerts for each environment as you can suppose or re-engineering them to consider the multitenancy, but this isn't an easy and quick job because you have to modify the indexes structure and all the alerts structure, in other words this is usually a job for Professional Services or at least for a Splunk Architect, not for a question in the Community. Ciao. Giuseppe ... View more

<base search> | rex "\{\x5c\"(?<_raw>[^\}]*)" | rex field=_raw mode=sed "s/\\\|\"//g" | kv pairdelim="," kvdelim=":" ... View more