Deployment Architecture

Can i use wildcard for the indexes.conf indexer name?

jondellfrjavier
Explorer

I am trying to use wildcard to the indexer name is it possible?

example:
i have indexes name with a patern name and same configuration of how and cold but different maxdatasize below

[index_name_1]
maxdatasize = 1000
homePath.maxDataSizeMB = 0
coldPath.maxDataSizeMB = 0

[index_name_2]
maxdatasize = 2000
homePath.maxDataSizeMB = 0
coldPath.maxDataSizeMB = 0

[index_name_3]
maxdatasize = 3000
homePath.maxDataSizeMB = 0
coldPath.maxDataSizeMB = 0

is it possible to add a index name on wildcard with the same configuration to apply for all of them on hot and cold configuration? like this

[index_name*]
homePath.maxDataSizeMB = 0
coldPath.maxDataSizeMB = 0

Tags (1)
0 Karma

micahkemp
Champion

You can not.

You can make changes to [default], but it will set the defaults for all indexes, not just the ones you potentially want to match. These defaults can obviously be overridden for individual indexes.

0 Karma

jondellfrjavier
Explorer

Hi micahkemp,

thank you for the answer 🙂

is there other way to change it globally? because default is not applicable to us because it will impacted all the indexes.

0 Karma

jondellfrjavier
Explorer

Hi micahkemp,

Thanks you for the answer 🙂

is there is other way to change it globally? because it was not applicable to us because it will impact all the indexes.

0 Karma

micahkemp
Champion

I do not believe so.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...