All,
I am rewriting my indexes.conf file. It had gotten pretty ugly over the years. I find myself writing the same values over and over again. Is there anyway to declare defaults?
For example, the paths and the frozenTimePeriodInSecs specifically?
[os]
repFactor=0
homePath = volume:splunksilver/os/db
coldPath = volume:splunksilver/os/colddb
thawedPath = $SPLUNK_DB/os/thaweddb
frozenTimePeriodInSecs = 2419200
[java]
repFactor=0
homePath = volume:splunksilver/java/db
coldPath = volume:splunksilver/java/colddb
thawedPath = $SPLUNK_DB/java/thaweddb
frozenTimePeriodInSecs = 2419200
Yes there is! If you put values outside any stanza they will apply to all unless overridden within a specific stanza. See the top of: https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Indexesconf
```
```
Yes there is! If you put values outside any stanza they will apply to all unless overridden within a specific stanza. See the top of: https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Indexesconf
```
```
Actually I should also add a note, that resolution of default values from the default stanza is done after the merging of all the configuration files from all apps as described in http://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Wheretofindtheconfigurationfiles
(Which with indexes the way that could bite you is that some of the shipped indexes.conf have specific stanza level settings in X/default/indexes.conf that would take precedence over default stanza setting in X/local/indexes.conf )
In short remember btool is your friend: https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Usebtooltotroubleshootconfigurati...