Follow this: http://docs.splunk.com/Documentation/Splunk/latest/admin/Setupmultipleindexes In the UI whatever context you are in (whichever app) when you click on the Manager link, that is where it will create or modify the indexes.conf file. Look in the 'local' directory under the app. So if you were in the Search app and created an index you'd find the changes in /etc/apps/search/local/. Then use the documentation and/or splunkbase to see how you want to change settings for the retention. ... View more