Getting Data In

indexes.conf: "default" vs "main" settings: which go into effect?

jbsplunk
Splunk Employee
Splunk Employee

I'm working to put in place a 400 day (34560000 second) data retention policy on the main (default) index.

At the indexer, when I run /splunk cmd btool --debug indexes list, I see:

[default]
system frozenTimePeriodInSecs = 188697600
...
[main]
xxxxxxx frozenTimePeriodInSecs = 34560000

Which of these two settings will go into effect? How can I get positive confirmation of the settings that are in effect?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

The information you see under [default] is a global setting that take precedence if you haven't defined a setting for a specific index. These settings come from /etc/system/default/indexes.conf. This can be a bit confusing as if you look into indexes.conf, global settings do not exist within a [default] stanza. Additionally, there is no need to create a [default] stanza.

If you take a look at the settings in $SPLUNK_HOME/etc/system/default/indexes.conf, you'll notice the settings for frozenTimePeriodInSecs matches the setting under this section:

# index specific defaults
frozenTimePeriodInSecs = 188697600

Since this setting also exists for [main], per the btool ouput, the setting for main takes precedence. This is part of the reason that btool is a technical support utility. The output can be confusing if you aren't sure what to expect. In this instance, since btool does show main as having the value defined, you can be sure that this is what will take effect. If you wanted to ensure all indexes had this behavior by default, you could copy the global settings from $SPLUNK_HOME/etc/system/default/indexes.conf into $SPLUNK_HOME/etc/system/local/indexes.conf.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

The information you see under [default] is a global setting that take precedence if you haven't defined a setting for a specific index. These settings come from /etc/system/default/indexes.conf. This can be a bit confusing as if you look into indexes.conf, global settings do not exist within a [default] stanza. Additionally, there is no need to create a [default] stanza.

If you take a look at the settings in $SPLUNK_HOME/etc/system/default/indexes.conf, you'll notice the settings for frozenTimePeriodInSecs matches the setting under this section:

# index specific defaults
frozenTimePeriodInSecs = 188697600

Since this setting also exists for [main], per the btool ouput, the setting for main takes precedence. This is part of the reason that btool is a technical support utility. The output can be confusing if you aren't sure what to expect. In this instance, since btool does show main as having the value defined, you can be sure that this is what will take effect. If you wanted to ensure all indexes had this behavior by default, you could copy the global settings from $SPLUNK_HOME/etc/system/default/indexes.conf into $SPLUNK_HOME/etc/system/local/indexes.conf.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...