I'm interested in setting up a Splunk server where each customer would have their own indexes and would only be able to search that one index.
However we'd definitely need to build the overall system such that the indexes, users, roles could be created on the fly without restarting the server.
I know you cannot create indexes on the fly in 4.1 (ie without restarting), and although the docs don't say that you can do this in 4.2, I thought I'd ask -- can this be done in 4.2 and if so how would you go about it?