I hope this is simple. Most conf files in Splunk, when overlapping in multiple apps, get essentially appended together at runtime. That may be an over simplification but it is the easiest way to understand it for me. How does this function for indexes.conf? Specifically, can I create an indexes.conf file to be included with a deployment client app that includes volume definitions (setting the size of hot and cold) that are common to all indexers, and then when we deploy other apps to my indexers, include a supplementary indexes.conf which only defines new indexes, and whose definitions refer to the hot and cold volumes defined in the deployment client, but don't themselves contain the volume definition? We must use volume definitions instead of static index sizes due to constantly changing source data specifications and the amount of data we deal with.
Any advice would be appreciated. I am hoping this isn't a rtfm type thing but I couldn't find the answer in the docs.
