Urgent: indexes.conf

[ponto]

Could someone tell me where can I find indexes.conf ?
Thanks in advance.

[DUThibault]

The shell command line find /opt/splunk -name indexes.conf will find all instances of indexes.conf in the Splunk directory tree.

[kamlesh_vaghela]

hi @ponto,

Can you please check below link?

https://answers.splunk.com/answers/50881/indexes-conf-location.html

[ponto]

I already read that answer but I can't understand where should I put the command ''enableDataIntegrityControl''. Do you know how can I do ?

[kamlesh_vaghela]

well, If your index is app specific or app level then store this configuration on app level means create indexes.conf in $SPLUNK_HOME/etc/apps/XXX/local OR if it is generic then create indexes.conf $SPLUNK_HOME/etc/system/local.

enableDataIntegrityControl option may be set under an [] entry.

enableDataIntegrityControl = true|false
* If set to true, hashes are computed on the rawdata slices and stored for
  future data integrity checks
* If set to false, no hashes are computed on the rawdata slices
* It has a global default value of false

eg. indexes.conf

[my_index]
enableDataIntegrityControl = true|false

Please check below link for more detail.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Indexesconf

Thanks