ok. I would recommend that you look at setting some best practices for your users that are onboarding data. You can do this as an admin by setting up indexes for them to use if necessary. However, if users are indexing data that is for the same purpose, it probably should exist in the same index. You would want to teach them how to search for their specific data based on hostname, source or sourcetype. You should take some time and look through this manual: http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor ... View more

It worked, thank you very much. ... View more