indexes.conf: "default" vs "main" settings: which go into effect?

[jbsplunk]

I'm working to put in place a 400 day (34560000 second) data retention policy on the main (default) index.

At the indexer, when I run /splunk cmd btool --debug indexes list, I see:

[default]
system frozenTimePeriodInSecs = 188697600
...
[main]
xxxxxxx frozenTimePeriodInSecs = 34560000

Which of these two settings will go into effect? How can I get positive confirmation of the settings that are in effect?

[jbsplunk · Accepted solution]

The information you see under [default] is a global setting that take precedence if you haven't defined a setting for a specific index. These settings come from /etc/system/default/indexes.conf. This can be a bit confusing as if you look into indexes.conf, global settings do not exist within a [default] stanza. Additionally, there is no need to create a [default] stanza.

If you take a look at the settings in $SPLUNK_HOME/etc/system/default/indexes.conf, you'll notice the settings for frozenTimePeriodInSecs matches the setting under this section:

# index specific defaults
frozenTimePeriodInSecs = 188697600

Since this setting also exists for [main], per the btool ouput, the setting for main takes precedence. This is part of the reason that btool is a technical support utility. The output can be confusing if you aren't sure what to expect. In this instance, since btool does show main as having the value defined, you can be sure that this is what will take effect. If you wanted to ensure all indexes had this behavior by default, you could copy the global settings from $SPLUNK_HOME/etc/system/default/indexes.conf into $SPLUNK_HOME/etc/system/local/indexes.conf.