Manual says to not go below an hour, but I am getting:
Invalid key in stanza [main] in /opt/splunk/etc/system/local/server.conf, line 46: maxHotSpanSecs (value: 31536000).
so it sounds like there is a max too.
That error message means the string on the left side of the =
is not recognized.
To find the correct attribute name, look in /opt/splunk/etc/system/README/server.conf.spec.
That error message means the string on the left side of the =
is not recognized.
To find the correct attribute name, look in /opt/splunk/etc/system/README/server.conf.spec.
looks like it is actually in indexes.conf.spec
but even there it says max value of 4294967295 which mine is less than.
and the "spec" is
maxHotSpanSecs =
which 31536000 certainly is
So I think the real problem is I have it in server.conf but it should be in indexes.conf under the main stanza, thanks for the clue!
Happy to help. If your problem is resolved, please accept the answer to help future readers.