http://www.splunk.com/support/forum:SplunkAdministration/2845 Sun, 21 Mar 2010 21:47:03 PDT Sun, 21 Mar 2010 21:47:03 PDT en-us http://creativecommons.org/licenses/by-nc-nd/2.5/ http://www.splunk.com/support/forum:SplunkAdministration/2845/9105 <p>Confirmed. You can set a global value for any value in indexes.conf and then override them on a per-index basis. If you do not specify a value, the values in system/default/indexes.conf will be applied.</p> Fri, 12 Jun 2009 10:06:41 PDT araitz http://www.splunk.com/support/forum:SplunkAdministration/2845/9105 http://www.splunk.com/support/forum:SplunkAdministration/2845/9097 <p>I'm working with version 3.4.10.</p> <p>I noticed in the documentation for indexes.conf these two parameters are specifically mapped to a particular index:</p> <p>frozenTimePeriodInSecs<br /> coldToFrozenScript</p> <p>Yet in the default indexes.conf, they are set globally in the file. My guess is that I can do either. I can set them globally, and/or set them for specific indexes. It would be nice if that was a little clearer.</p> <p>Can someone confirm or deny this?</p> Fri, 12 Jun 2009 07:11:59 PDT rotten http://www.splunk.com/support/forum:SplunkAdministration/2845/9097