I feel like I'm asking a question I should know the answer to. We are setting up what will be a large and distributed splunk environment. The probable scenario is individual orgs will have one or more forwarders and we'd like to have all of the data from any particular org going into its own index regardless of log content: OS, firewall, etc. Unless I'm off base the place to configure which index data will go is the inputs.conf file. Even though we will be using a deployment server the individual orgs will be responsible for installing the UF/HF and ultimately will have access to modify things like the etc/local/inputs.conf file even if we tell them not to.
Since the forwarder builds the inputs.conf file from the various places it can reside my thought is to create an inputs.conf app for all forwarders in an org that says regardless of WHAT is being ingested to put it in the right index. This would be appended to whatever they might tweak outside of my perview. Is this the right approach and how do I accomplish this? My thought is something like the following
deployment-apps/all_forwarders_in_org_xyz_inputs/local/inputs.conf
[source:*]
index=xyz's_index
That stanza string doesn't strike me as the right way to approach this.
