Archive

Palo Alto Networks App limit data storage - send to frozen

Path Finder

Which file do I edit to change frozen time period for the PA indexes? I'm not seeing an indexes.conf file for the app or TA.

0 Karma

Path Finder

Ah, found it. It's now part of the search app indexes.conf. Also, a quick look at 'Indexes' in the splunk gui tells you where to look...will make sure to remember this for next time.

0 Karma