I have a doubt about which can be the best practice about indexing if:
I have several splunk client forwarding to the same splunk server the same logs folder. Each night the logs are updated but no logs contain the host name to distinguish among them.
Now my doubt/question is: should I use different indexes per hosts? in such a case a could use different clones of the same app on each host right?
Does anybody has a better how-to or best practice?
Many thanks in advance Cdf.
... View more