Hello splunkers,
I ran into this earlier and couldn't find a post on it. So, now that I fixed myself, I thought I would share.
Issue: When trying to add a new index I get the following error message.
The following issues were found with submitted configuration:
stanza=osnixperf parameter=frozenTimePeriodInSecs Value supplied='604800 #7 days' is illegal; default='188697600'
stanza=oswinperf parameter=frozenTimePeriodInSecs Value supplied='604800 #7 days' is illegal; default='188697600'
This is the result of a typo in the indexes.conf file for the "Org_all_indexes" custom app. File path for me was splunk\etc\apps\org_all_indexes\default\indexes.conf
For me it was on line 66 and line 93. The comment (#7 days) needs to be move to a new line.
After making the changes you will need to restart Splunk.
Note: This app does not have a local folder.
Hope that this will save others some time.
Happy Splunking
