https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462378#M79798 <P>Great explanation and Splunk doc.</P> <P>Thank you,</P> Thu, 06 Feb 2020 21:16:22 GMT vnguyen46 2020-02-06T21:16:22Z https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462373#M79793 <P>Hi,</P> <P>I have a HF with 250 GB dedicated to /opt directory and this space is being filled up quickly, while I set:<BR /> indexAndForward = false in outputs.conf file</P> <P>Anyone knows why this happens?</P> <P>Thanks, </P> Wed, 05 Feb 2020 17:38:38 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462373#M79793 vnguyen46 2020-02-05T17:38:38Z https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462374#M79794 <P>do you see indexed data in var/lib/splunk on HF?</P> Wed, 05 Feb 2020 19:41:29 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462374#M79794 Vijeta 2020-02-05T19:41:29Z https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462375#M79795 <P>Vijeta - yes, I see indexed data in that dir which I was aware of.<BR /> I have 14 indexers in a cluster. Do you think I can remove the indexed data as I only need the HF to parse and forward data to the indexers, not stored data there?</P> <P>Thanks, </P> Wed, 05 Feb 2020 19:47:27 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462375#M79795 vnguyen46 2020-02-05T19:47:27Z https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462376#M79796 <P>If the data is present on indexers , then there is no need of keeping the data on Heavy Forwarder. Please check if you are indexers are having same files after that you can delete these files on heavy forwarder. Also make sure your indexAndForward is not set to true any where on HF. May be start with deleting with few files that are least important to empty the space.</P> Wed, 05 Feb 2020 19:55:16 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462376#M79796 Vijeta 2020-02-05T19:55:16Z https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462377#M79797 <P>Check which indexes are filling up the space. If it's _internal index (var/lib/splunk/_internaldb) then you might now be forwarding you internal logs from HF to Indexers. You would need to setup outputs.conf for that. Below link shows steps for that. The below link is for Search Heads but configuration is same for HF as well. (or any other Splunk instance)</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/DistSearch/Forwardsearchheaddata" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.1/DistSearch/Forwardsearchheaddata</A></P> Wed, 30 Sep 2020 04:03:15 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462377#M79797 somesoni2 2020-09-30T04:03:15Z https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462378#M79798 <P>Great explanation and Splunk doc.</P> <P>Thank you,</P> Thu, 06 Feb 2020 21:16:22 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462378#M79798 vnguyen46 2020-02-06T21:16:22Z https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462379#M79799 <P>Great follow-up document that gave me a better understanding on outputs.conf</P> <P>Thanks,</P> Thu, 06 Feb 2020 21:17:57 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-heavy-forwarder-running-out-of-disk-space-quickly/m-p/462379#M79799 vnguyen46 2020-02-06T21:17:57Z