[socradar_incidents]
coldPath = $SPLUNK_DB/socradar_incidents/colddb
homePath = $SPLUNK_DB/socradar_incidents/db
thawedPath = $SPLUNK_DB/socradar_incidents/thaweddb