isReadOnly is

bsrikanthreddy5 — Thu, 05 Nov 2020 00:17:41 GMT

Hi,

In smart store splunk clusters with smart store enabled on all indexes with remotePath in [default} stanza, Is there a way disable an index or make an index readonly ?

# splunk smart-store settings
[default]
remotePath = volume:remote_store/$_index_name

disabled = <boolean>
* Toggles your index entry off and on.
* Set to "true" to disable an index.
* CAUTION: Do not set this setting to "true" on remote storage enabled indexes.
* Default: false

isReadOnly = <boolean>
* Whether or not the index is read-only.
* If you set to "true", no new events can be added to the index, but the
  index is still searchable.
* You must restart splunkd after changing this setting. Reloading the
  index configuration does not suffice.
* Do not configure this setting on remote storage enabled indexes.
* If set to 'true', replication must be turned off (repFactor=0) for the index.
* Default: false

topic isReadOnly is in Getting Data In

isReadOnly is