topic Re: disk space error in Monitoring Splunk

disk space error

s_unny — Tue, 06 Aug 2024 20:52:22 GMT

The diskspace remaining=6235 has breached the yellow threshold for filesystems=['C:\Program Files\Splunk\var\lib\splunk\_introspection\db' 'C:\Program Files\Splunk\var\lib\splunk\_internaldb\db' 'C:\Program Files\Splunk\var\lib\splunk\audit\db' 'C:\Program Files\Splunk\var\lib\splunk\_configtracker\db' 'C:\Program Files\Splunk\var\lib\splunk\audit\colddb' 'C:\Program Files\Splunk\var\lib\splunk\_metrics\db' 'C:\Program Files\Splunk\var\lib\splunk\_configtracker\colddb']

Hi, I am new to Splunk, I am using Splunk enterprise on my laptop, and I have been getting this error about disk space, please help me to solve it

Re: disk space error

isoutamo — Tue, 06 Aug 2024 22:12:35 GMT

if I understood right you issue, you have used too much of SPLUNK_DB space on your system. There are many instructions on net, how to move/change SPLUNK_DB into another Drive on Windows which you need to do. Another option is limit your disk space to lower, but probably this will denied to collect enough events to your system.

Another option is ask some local Splunk Partner to fix this for you.

r. Ismo

Re: disk space error

gcusello — Wed, 07 Aug 2024 07:22:50 GMT

Hi @s_unny ,

as also @isoutamo said, you don't have enough disk space on your desktop.

I hint to reduce the retention time of your indexes, starting from _internal and the most large indexes.

Ciao.

Giuseppe