Deployment Architecture

Not able to create new index in standalone instance of Splunk indexer

rupeshn
Explorer

Hi All, I've created new app with all the indexes required and have added all the stanzas for parameters.Restarted the Splunk on Indexer. Now when i login all is good. The indexes are reflected in GUI and logs are ingesting. But when i try to create new index. It is throwing e a below error.

stanza=alm_win_allservers parameter=frozenTimePeriodInSecs Value supplied='12096000‬' is illegal; default='188697600' Could you please help here

Tags (2)
0 Karma
1 Solution

anilchaithu
Builder

@rupeshn 

looks like the stanza is not thinking this as an integer. Did you copy this value from elsewhere? try to enter the value manually and check.

View solution in original post

anilchaithu
Builder

@rupeshn 

looks like the stanza is not thinking this as an integer. Did you copy this value from elsewhere? try to enter the value manually and check.

rupeshn
Explorer

Sorry! I did not get time to check on this. Today i checked it and it worked fine.

 

Thank You!

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...