I think the solution to your issue is to create an inputs file for your forwarder to divert the data into the appropriate index. That's the short version at least. A simplistic example is [monitor:///var/foo] Index = main [monitor::///var/bar] Index = new_index Alternatively you could put data into different indices through props/transforms and while that isn't hard per se there are a few more steps. Can you give a few more particulars about your environment (eg are you using a deployment server), OS, and data paths involved? ... View more

You definitely want to ingest that data into its own index, then you can limit the users who have rights to view that index. An index is the smallest unit that you can apply an ACL to. Are you using local splunk logins or are you using ldap authentication? Basically, you create roles within splunk and either map users to those roles within splunk or you can map ldap groups to those roles and control the group membership in a directory service like Microsoft Active Directory. ... View more