Hi Team,
I am getting below error in spluk local insatance :
Error details :
Invalid key in stanza [tcp01] in C:\Program Files\Splunk\etc\app
s\XYZ_test_local\default\indexes.conf, line 5: maxTotalDatasize (value: 1024MB
).
Invalid key in stanza [tcp01] in C:\Program Files\Splunk\etc\app
s\XYZ_test_local\default\indexes.conf, line 7: maxWarmDBcount (value: 4).
Your indexes and inputs configurations are not internally consistent
tent.
Indexes.conf :
[tcp01]
coldPath = $SPLUNK_DB/tcp01/colddb
homePath = $SPLUNK_DB/tcp01/db
thawedPath = $SPLUNK_DB/tcp01/thaweddb
maxTotalDatasize = 1024MB
maxHotSpanSecs = 243264
maxWarmDBcount = 4
maxHotbuckets = 3
disabled = false
[monitor://C:\Program Files\Splunk\XYZ_Alerts*]
sourcetype=st01
index=tcp01
blacklist=.(gz|zip)$
initCrcLength=750
Hi @02sangeet,
about the first error, the correct paramer is:
maxTotalDatasizeMB = 1024
as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Indexesconf
About the second, I don't see any formal error, are you sure of value of 4? default is 300!
check if there's a special char like tab.
Ciao.
Giuseppe
Case is significant. The correct attribute names are maxTotalDataSizeMB
and maxWarmDBCount
.
The value of maxWarmDBCount
should be an integer. No "MB" suffix.