topic Re: What is the max value for maxHotSpanSecs in Getting Data In

What is the max value for maxHotSpanSecs

stevesmoot — Sat, 25 Aug 2018 00:13:24 GMT

Manual says to not go below an hour, but I am getting:
Invalid key in stanza [main] in /opt/splunk/etc/system/local/server.conf, line 46: maxHotSpanSecs (value: 31536000).
so it sounds like there is a max too.

Re: What is the max value for maxHotSpanSecs

richgalloway — Sat, 25 Aug 2018 17:26:31 GMT

That error message means the string on the left side of the = is not recognized.

To find the correct attribute name, look in /opt/splunk/etc/system/README/server.conf.spec.

Re: What is the max value for maxHotSpanSecs

stevesmoot — Sat, 25 Aug 2018 17:38:10 GMT

looks like it is actually in indexes.conf.spec
but even there it says max value of 4294967295 which mine is less than.
and the "spec" is
maxHotSpanSecs =
which 31536000 certainly is

So I think the real problem is I have it in server.conf but it should be in indexes.conf under the main stanza, thanks for the clue!

Re: What is the max value for maxHotSpanSecs

richgalloway — Sat, 25 Aug 2018 22:11:47 GMT

Happy to help. If your problem is resolved, please accept the answer to help future readers.