topic How on earth do I edit indexes.conf in Getting Data In

How on earth do I edit indexes.conf

oranger1426 — Thu, 18 Apr 2013 10:15:50 GMT

indexes.conf is set to read only

I can't even change my frozenbucket retention period

Re: How on earth do I edit indexes.conf

Ayn — Thu, 18 Apr 2013 10:32:15 GMT

Make it writeable?

Re: How on earth do I edit indexes.conf

LukeMurphey — Fri, 19 Apr 2013 00:37:08 GMT

Are you attempting to edit the file in the default directory? If so, you should be overriding the entries in default with a file in the local directory. See the docs for more info.

Re: How on earth do I edit indexes.conf

oranger1426 — Fri, 19 Apr 2013 05:31:20 GMT

so where do I edit indexes.conf?

Re: How on earth do I edit indexes.conf

sinclairmachado — Fri, 19 Apr 2013 05:43:36 GMT

If you are on the indexer, check the path /opt/splunk/etc/system/local/indexes.conf