Splunk Time Based Retention

[nspatel]

Hi Everyone,

I am trying to have Splunk Auto delete data older then a year.

My /opt/splunk/etc/system/local/inputs.conf looks like this:

[default]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304

When I restart splunk I get this error.

Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 2: maxHotSpanSecs (value: 7776000)
Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 3: frozenTimePeriodInSecs (value: 31557600)
Invalid key in stanza [default] in /opt/splunk/etc/system/local/inputs.conf, line 4: maxTotalDataSizeMB (value: 4194304)

What am I doing wrong?

[the_wolverine · Accepted solution]

These settings belong in indexes.conf, not inputs.conf. So, Splunk is warning you that you have invalid stanzas in your inputs.conf.

[nspatel]

Ha! Bonehead mistake.

Do you know if the values can be applied globally or if they have to be per index?

Can I do exactly what I have (just in the right location) or do I need to the following

[index1]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304

[index2]
maxHotSpanSecs=7776000
frozenTimePeriodInSecs = 31557600
maxTotalDataSizeMB = 4194304

and so forth?

[the_wolverine]

Yes you can set those values globally by using [default] stanza. Then eliminate those settings from the index-specific stanzas. Feel free to refer to spec file in /opt/splunk/etc/system/README/ for the config file in question.