Getting Data In

How on earth do I edit indexes.conf

oranger1426
Explorer

indexes.conf is set to read only

I can't even change my frozenbucket retention period

Tags (1)
0 Karma

sinclairmachado
Explorer

If you are on the indexer, check the path /opt/splunk/etc/system/local/indexes.conf

0 Karma

oranger1426
Explorer

so where do I edit indexes.conf?

0 Karma

LukeMurphey
Champion

Are you attempting to edit the file in the default directory? If so, you should be overriding the entries in default with a file in the local directory. See the docs for more info.

Ayn
Legend

Make it writeable?