I have multiple environments (QA, PreProd, Prod) sending data to splunk, and I'm using deployment server to manage all forwarders. I'm thinking of creating an "app" called Linux, that will "configure" or "add" the input I want to monitor for that specific kind app (i.e: Linux), but I want to separate the data into different indexes (or tag them in some way) by environment but I didn't realize how can I do that, if possible. Ex: /etc/deployment-apps/linux/local/inputs: [monitor:///var/log/messages] disabled = false sourcetype = linux_messages_syslog [monitor:///var/log/secure] disabled = false sourcetype = linux_secure Then I would want to tie this app to various server-class. Something like: LinuxProd, LinuxQA, etc. And for that tie, I want to set the index. LinuxQA will have the same inputs as LinuxProd but different indexes. I know I can achieve that by creating different apps with, something like this: Ex: /etc/deployment-apps/linux_qa/local/inputs: [monitor:///var/log/messages] disabled = false sourcetype = linux_messages_syslog index = linux_qa [monitor:///var/log/secure] disabled = false sourcetype = linux_secure index = linux_qa And /etc/deployment-apps/linux_prod/local/inputs: [monitor:///var/log/messages] disabled = false sourcetype = linux_messages_syslog index = linux_prod [monitor:///var/log/secure] disabled = false sourcetype = linux_secure index = linux_prod But that doesn't feel right. Any help would be really appreciated. Thanks ... View more