Hi Everyone,
I am trying to have Splunk Auto delete data older then a year.
My /opt/splunk/etc/system/local/inputs.conf looks like this:
[default]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304
When I restart splunk I get this error.
Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 2: maxHotSpanSecs (value: 7776000)
Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 3: frozenTimePeriodInSecs (value: 31557600)
Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 4: maxTotalDataSizeMB (value: 4194304)
What am I doing wrong?
These settings belong in indexes.conf, not inputs.conf. So, Splunk is warning you that you have invalid stanzas in your inputs.conf.
These settings belong in indexes.conf, not inputs.conf. So, Splunk is warning you that you have invalid stanzas in your inputs.conf.
Ha! Bonehead mistake.
Do you know if the values can be applied globally or if they have to be per index?
Can I do exactly what I have (just in the right location) or do I need to the following
[index1]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304
[index2]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304
and so forth?
Yes you can set those values globally by using [default] stanza. Then eliminate those settings from the index-specific stanzas. Feel free to refer to spec file in /opt/splunk/etc/system/README/ for the config file in question.