Cannot edit the index setting. As Argument "coldPath_expanded" is not supported by this handler.

[All-done-steak]

Cannot edit the index setting as it shows an error said "Argument "coldPath_expanded" is not supported by this handler".

Splunk Enterprise version: 8.2.4

[PickleRick]

Since there is no such setting for indexes.conf there are two possible reasons.

1. Less likely - you have this setting set somewhere. Look for it with either find | grep or with splunk btool and remove

2. More likely - you hit some frontend issue and coldPath_expanded is a variable existing only on your browser's side for some strange reason. In such case it's probably a support case material.

[VatsalJagani]

Agreed, if it is UI issue, then go with Splunk support case.

[VatsalJagani]

@All-done-steak- Please check indexes.conf in the Splunk backend. There seems to be some issue with some config written in indexes.conf.

You can find indexes.conf files with find command in Linux:

find /opt/splunk -name "indexes.conf"

I hope this helps!!!