The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Previous Topic: syslog tcp vs udp input + netscreen | Next Topic: Forwarding
Posts 1–2 of 2
I'm working with version 3.4.10.
I noticed in the documentation for indexes.conf these two parameters are specifically mapped to a particular index:
frozenTimePeriodInSecs
coldToFrozenScript
Yet in the default indexes.conf, they are set globally in the file. My guess is that I can do either. I can set them globally, and/or set them for specific indexes. It would be nice if that was a little clearer.
Can someone confirm or deny this?
Confirmed. You can set a global value for any value in indexes.conf and then override them on a per-index basis. If you do not specify a value, the values in system/default/indexes.conf will be applied.