Hello, Splunk offers the option of saving changes made in an app via Splunk Web directly to the default directory. By default, Splunk saves all changes made via the Splunk Web interface in the local directory. Is there a possibility that the changes are saved directly to the default directory? Some more information about the background of the question: For my Splunk instances, the config management is done using Gitlab. All config files in the apps are pushed to the corresponding Splunk instances in the default directory. When I clone an app to my Dev-Splunk instance and make changes, these are saved in the corresponding local directory. Before I can push the changes to my Prod-Splunk instance via Gitlab, I have to manually copy the changes from local/config files to the default/config files. This step is quite tedious as soon as it is not just a single config file. Have any of you already had the same problem and can give me a tip as to whether this is technically possible in Splunk? best regards Lukas ... View more

Hello, I have defined a frozenTimePeriodInSecs for 1 hour on my IDX for a certain index, so that the logs it contains are only kept for 1 hour. The definition of the frozenTimePeriodInSecs was made in the indexes.conf in the system/local directory The problem I have, however, is that the frozenTimePeriodInSecs config only takes effect once when the IDX is restarted. Otherwise, the logs remain in this index for the defined retention period. Has anyone already had the same problem and can help me with this? Thanks in advance. ... View more