topic Re: Minimum free disk space reached in Getting Data In

Minimum free disk space reached

TaraPennington — Mon, 22 Feb 2021 17:46:55 GMT

I just got Splunk ingesting some data and now I'm getting this error message. I found several posts related to this but they are 6 years old and I think they are out of date. One of them said to go to the server.conf file and edit this stanza, but I don't see that stanza in the file. Is that stanza in another location?

[diskUsage]
minFreeSpace = <num>

Re: Minimum free disk space reached

gcusello — Mon, 22 Feb 2021 17:50:36 GMT

Hi @TaraPennington,

The problem is that you reached the minimum disk space in the dispatched folder.

You have to delete the oldest folders and files in the folder $SPLUNK_HOME/var/run/splunk (after Splunk stop) and then restart Splunk.

Ciao.

Giuseppe

Re: Minimum free disk space reached

TaraPennington — Mon, 22 Feb 2021 17:57:52 GMT

Okay do I need to stop splunk on the forwarders then?

Also, the files that need to be deleted are on the splunk server? (single instance).

Re: Minimum free disk space reached

gcusello — Mon, 22 Feb 2021 18:03:08 GMT

Hi @TaraPennington,

The problem is a search problem so only on Indexer (your single instance).

Ciao.

Giuseppe