How on earth do I edit indexes.conf

[oranger1426]

indexes.conf is set to read only

I can't even change my frozenbucket retention period

[sinclairmachado]

If you are on the indexer, check the path /opt/splunk/etc/system/local/indexes.conf

[oranger1426]

so where do I edit indexes.conf?

[LukeMurphey]

Are you attempting to edit the file in the default directory? If so, you should be overriding the entries in default with a file in the local directory. See the docs for more info.

[Ayn]

Make it writeable?