how to archive

[jmp13]

I am reading up on how to archive and set the frozen bucket. Do i need to create my own indexes.conf file ? One is not in the system/local directory.

[default]
maxWarmDBCount = 200
frozenTimePeriodInSecs = 432000
rotatePeriodInSecs = 30
coldToFrozenDir = "$SPLUNK_HOME\myfrozenarchive"
This is in the example file. What is maxWarmDBCount and rotatePeriodInSecs? These are not in the documenation. Do I need to change default to index? My data is grown and i want to archive it.

[lukejadamec]

Yes. Splunk does not create files in the local directory unless it is copying them from a previous install. If you create an empty indexes.conf file in the local directory, and then put in the modifications you want, then those modifications will take precedence over those in the default directory. And, they will be preserved if you upgrade Splunk in the future.

The attributes you mention are in the documentation. Perhaps you're looking at an older version? Look here, and you will see them. If you are using an older version then change the version number in the upper right dropdown:

http://docs.splunk.com/Documentation/Splunk/6.0.1/admin/Indexesconf

[lukejadamec]

Also, all events in the bucket must be older than the frozenTimePeriodsInSeconds, and if the default\indexes.conf specifies a value at the index level then the value you set at the default level will not work. Index level settings take precedence over default level settings.

[lukejadamec]

What do you mean it does not start?
The coldToFrozenDir is an index level attribute. I don't think it can be set at the default level, and even if you could I doubt you want to because it would save all indexes including the internal ones.
Set the coldtoFrozenDir in a index level stanza, for example to set the value for the main index:
[default]
frozenTimePeriodInSecs = 31104000
[main]
coldToFrozenDir = "e:archine"

[jmp13]

I entered in the indexes.conf file
[default]
frozenTimePeriodInSecs = 31104000
coldToFrozenDir = "e:\archine"

put this in the system\local directory then restart splunk and it does not start. Is there something I am missing that I need to do? I followed the documentation so I do i need more than that in the file?