Forums: SplunkAdministration: indexes.conf frozen db management

Previous Topic: syslog tcp vs udp input + netscreen  |   Next Topic: Forwarding


Posts 1–2 of 2  |  Post to this topic
1
rotten's Mugshot posted by: rotten  |  posts
date: June 12, 2009
permalink

I'm working with version 3.4.10.

I noticed in the documentation for indexes.conf these two parameters are specifically mapped to a particular index:

frozenTimePeriodInSecs
coldToFrozenScript

Yet in the default indexes.conf, they are set globally in the file. My guess is that I can do either. I can set them globally, and/or set them for specific indexes. It would be nice if that was a little clearer.

Can someone confirm or deny this?

2
araitz's Mugshot posted by: araitz  |  posts
date: June 12, 2009
permalink

Confirmed. You can set a global value for any value in indexes.conf and then override them on a per-index basis. If you do not specify a value, the values in system/default/indexes.conf will be applied.

Post to this topic

You must be logged in to post a reply.