How do I fix "The following issues were found with submitted configuration ... Value supplied is illegal" when trying to add a new index?

jackal713 — Tue, 29 Sep 2020 22:28:10 GMT

Hello splunkers,
I ran into this earlier and couldn't find a post on it. So, now that I fixed myself, I thought I would share.
Issue: When trying to add a new index I get the following error message.
The following issues were found with submitted configuration:
stanza=osnixperf parameter=frozenTimePeriodInSecs Value supplied='604800 #7 days' is illegal; default='188697600'
stanza=oswinperf parameter=frozenTimePeriodInSecs Value supplied='604800 #7 days' is illegal; default='188697600'

This is the result of a typo in the indexes.conf file for the "Org_all_indexes" custom app. File path for me was splunk\etc\apps\org_all_indexes\default\indexes.conf
For me it was on line 66 and line 93. The comment (#7 days) needs to be move to a new line.
After making the changes you will need to restart Splunk.
Note: This app does not have a local folder.

Hope that this will save others some time.
Happy Splunking

Re: How do I fix "The following issues were found with submitted configuration ... Value supplied is illegal" when trying to add a new index?

martin_mueller — Wed, 26 Dec 2018 20:45:28 GMT

self-answered in the question 🙂

topic Re: How do I fix "The following issues were found with submitted configuration ... Value supplied is illegal" when trying to add a new index? in Deployment Architecture

How do I fix "The following issues were found with submitted configuration ... Value supplied is illegal" when trying to add a new index?

Re: How do I fix "The following issues were found with submitted configuration ... Value supplied is illegal" when trying to add a new index?