Hi,
I'm trying to delete old data due to space issue and I found this http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy.
But then I found that I have 4 indexes.conf on my linux. Which one should I edit?
![alt text][1]
[1]: /storage/temp/217903-capture.jpg
↧