I'm trying to source what
indexes.conf is being utilized for each index; for example, I have an index called Web. What I'd like to configure is the total max size of 275GB for that index using a retirement and archiving policy (maxTotalDataSizeMB). But I don't know what index applies to what Indexes.conf (several are listed). Further, can I set up a different index to use as indexes.conf (not the default)?
you can use the following Splunk CLI command:
$SPLUNK_HOME/bin/splunk btool indexes list --debug
This will show you the config file path so you will know where to change the settings.
And yes, you should use your own file in either
Never change any setting in any file in
Hope this helps ...
Sorry posted it wrong; I used ./btool indexes list --debug
Also used the username splunk with ./btool indexes list --debug
/opt/splunk/bin/splunkd: error while loading shared libraries: libjemalloc.so.2: cannot open shared object file: No such file or directory
you are not using the command I posted and most likely you are doing it not as the splunk user. Switch user to the Splunk user account (in most cases
splunk) and run the correct command as posted 😉