What is the max value for maxHotSpanSecs

[stevesmoot]

Manual says to not go below an hour, but I am getting:
Invalid key in stanza [main] in /opt/splunk/etc/system/local/server.conf, line 46: maxHotSpanSecs (value: 31536000).
so it sounds like there is a max too.

[richgalloway · Accepted solution]

That error message means the string on the left side of the = is not recognized.

To find the correct attribute name, look in /opt/splunk/etc/system/README/server.conf.spec.

[stevesmoot]

looks like it is actually in indexes.conf.spec
but even there it says max value of 4294967295 which mine is less than.
and the "spec" is
maxHotSpanSecs =
which 31536000 certainly is

So I think the real problem is I have it in server.conf but it should be in indexes.conf under the main stanza, thanks for the clue!

[richgalloway]

Happy to help. If your problem is resolved, please accept the answer to help future readers.