Manual says to not go below an hour, but I am getting:
Invalid key in stanza [main] in /opt/splunk/etc/system/local/server.conf, line 46: maxHotSpanSecs (value: 31536000).
so it sounds like there is a max too.
↧