So whilst modifying my index cluster configuration to be a little smarter with what data is maintained between hot/warm/cold/frozen, I'm a little stuck with maxWarmDBcount.
So if i try and push the following in my _cluster/local/indexes.conf
maxWarmDBcount = 100
homePath = $SPLUNK_DB/test/db
coldPath = $SPLUNK_DB/test/colddb
thawedPath = $SPLUNK_DB/test/thaweddb
repFactor = auto
maxDataSize = 500
it fails with the following
Invalid key in stanza [test2] in /opt/splunk/etc/master-apps/_cluster/local/indexes.conf, line 298: maxWarmDBcount (value: 100).
If i comment out the maxWarmDBcount line it works fine.
I have tried this on multiple index's with varying rules to no avail. Any advise would be welcome !
↧