Getting Data In

Splunk Time Based Retention

nspatel
Explorer

Hi Everyone,

I am trying to have Splunk Auto delete data older then a year.

My /opt/splunk/etc/system/local/inputs.conf looks like this:

[default]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304

When I restart splunk I get this error.

Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 2: maxHotSpanSecs (value: 7776000)
Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 3: frozenTimePeriodInSecs (value: 31557600)
Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 4: maxTotalDataSizeMB (value: 4194304)

What am I doing wrong?

1 Solution

the_wolverine
Champion

These settings belong in indexes.conf, not inputs.conf. So, Splunk is warning you that you have invalid stanzas in your inputs.conf.

View solution in original post

the_wolverine
Champion

These settings belong in indexes.conf, not inputs.conf. So, Splunk is warning you that you have invalid stanzas in your inputs.conf.

View solution in original post

nspatel
Explorer

Ha! Bonehead mistake.

Do you know if the values can be applied globally or if they have to be per index?

Can I do exactly what I have (just in the right location) or do I need to the following

[index1]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304

[index2]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304

and so forth?

0 Karma

the_wolverine
Champion

Yes you can set those values globally by using [default] stanza. Then eliminate those settings from the index-specific stanzas. Feel free to refer to spec file in /opt/splunk/etc/system/README/ for the config file in question.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!