I created a new F: drive for my archiving or Frozen path. Currently everything is configured to the default and filling up my C: drive. How do I configure my indexes.conf to have my coldtofrozenpath to be on the F: drive?
you can put indexes.conf in one app (custom or default) or in $SPLUNK_HOME/etc/system/local (but I don't like!).
I usually put each of them in the related App.
So You can insert in your indexes.conf a stanza like this: