topic Re: Error: Invalid key stanza in Getting Data In

Error: Invalid key stanza

02sangeet — Wed, 30 Sep 2020 04:05:22 GMT

Hi Team,
I am getting below error in spluk local insatance :

Error details :

            Invalid key in stanza [tcp01] in C:\Program Files\Splunk\etc\app

s\XYZ_test_local\default\indexes.conf, line 5: maxTotalDatasize (value: 1024MB
).
Invalid key in stanza [tcp01] in C:\Program Files\Splunk\etc\app
s\XYZ_test_local\default\indexes.conf, line 7: maxWarmDBcount (value: 4).

          Your indexes and inputs configurations are not internally consistent

tent.

Indexes.conf :

[tcp01]
coldPath = $SPLUNK_DB/tcp01/colddb
homePath = $SPLUNK_DB/tcp01/db
thawedPath = $SPLUNK_DB/tcp01/thaweddb
maxTotalDatasize = 1024MB
maxHotSpanSecs = 243264
maxWarmDBcount = 4
maxHotbuckets = 3
disabled = false

[monitor://C:\Program Files\Splunk\XYZ_Alerts*]
sourcetype=st01
index=tcp01
blacklist=.(gz|zip)$
initCrcLength=750

Re: Error: Invalid key stanza

richgalloway — Tue, 11 Feb 2020 16:44:08 GMT

Case is significant. The correct attribute names are maxTotalDataSizeMB and maxWarmDBCount.

The value of maxWarmDBCount should be an integer. No "MB" suffix.

Re: Error: Invalid key stanza

gcusello — Tue, 11 Feb 2020 16:50:10 GMT

Hi @02sangeet,
about the first error, the correct paramer is:

maxTotalDatasizeMB = 1024

as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Indexesconf

About the second, I don't see any formal error, are you sure of value of 4? default is 300!
check if there's a special char like tab.

Ciao.
Giuseppe