topic Re: The index processor has paused data flow in Installation

The index processor has paused data flow

ajangiti123 — Thu, 31 Oct 2019 15:58:38 GMT

The index processor has paused data flow. Current free disk space on partition '/' has fallen to 4665MB, below the minimum of 5000MB. Data writes to index path '/opt/splunk/var/lib/splunk/audit/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data

Re: The index processor has paused data flow

nplamondon — Thu, 31 Oct 2019 19:15:50 GMT

This message is fairly self-explanatory...

What's your question?

Re: The index processor has paused data flow

sduff_splunk — Thu, 31 Oct 2019 23:05:09 GMT

Your storage has less than 5GB available. Splunk will pause indexing until more storage is available.

Alternatively, you can change the minmum free disk space required by going to https://localhost:8000/en-US/manager/launcher/server/settings/settings?action=edit OR editing server.conf

[diskUsage]
minFreeSpace = <num>|<percentage>
# default = 5000MB (5GB)

This is not recommended however. Just free up some space, and Splunk will continue indexing.

Re: The index processor has paused data flow

ac89live — Sun, 11 Oct 2020 07:05:37 GMT

Is it possible the system do rotation to data older that specified X time ?

Re: The index processor has paused data flow

isoutamo — Sun, 11 Oct 2020 07:57:31 GMT

Just define shorter retention time for indexes. But usually this is not an option. Basically you must add more space to your system.
In best practices you should start to use volumes which automatically freeze old data and make new space available on your index storages.
https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Configureindexstoragesize
r. Ismo