Which file do I edit to change frozen time period for the PA indexes? I'm not seeing an indexes.conf file for the app or TA.
Ah, found it. It's now part of the search app indexes.conf. Also, a quick look at 'Indexes' in the splunk gui tells you where to look...will make sure to remember this for next time.
