Hi,
In smart store splunk clusters with smart store enabled on all indexes with remotePath in [default} stanza, Is there a way disable an index or make an index readonly ?
# splunk smart-store settings
[default]
remotePath = volume:remote_store/$_index_name
disabled = <boolean>
* Toggles your index entry off and on.
* Set to "true" to disable an index.
* CAUTION: Do not set this setting to "true" on remote storage enabled indexes.
* Default: false
isReadOnly = <boolean>
* Whether or not the index is read-only.
* If you set to "true", no new events can be added to the index, but the
index is still searchable.
* You must restart splunkd after changing this setting. Reloading the
index configuration does not suffice.
* Do not configure this setting on remote storage enabled indexes.
* If set to 'true', replication must be turned off (repFactor=0) for the index.
* Default: false
