Deployment Architecture

Error applying with indexes.conf when adding maxWarmDBcount

Joshuachurchill
Engager

So whilst modifying my index cluster configuration to be a little smarter with what data is maintained between hot/warm/cold/frozen, I'm a little stuck with maxWarmDBcount.

So if i try and push the following in my _cluster/local/indexes.conf
maxWarmDBcount = 100
homePath = $SPLUNK_DB/test/db

coldPath = $SPLUNK_DB/test/colddb
thawedPath = $SPLUNK_DB/test/thaweddb
repFactor = auto
maxDataSize = 500

it fails with the following
Invalid key in stanza [test2] in /opt/splunk/etc/master-apps/_cluster/local/indexes.conf, line 298: maxWarmDBcount (value: 100).

If i comment out the maxWarmDBcount line it works fine.

I have tried this on multiple index's with varying rules to no avail. Any advise would be welcome !

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi

It should be maxWarmDBCount not maxWarmDBcount

Thanks
Harshil

View solution in original post

harsmarvania57
Ultra Champion

Hi

It should be maxWarmDBCount not maxWarmDBcount

Thanks
Harshil

Joshuachurchill
Engager

Thanks so much! Really feel like a noob after that one. 🙂

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...