topic Re: Splunk Disk Reporting Incorrect in Monitoring Splunk

Splunk Disk Reporting Incorrect

trevor_dunstan8 — Wed, 14 Oct 2020 03:56:08 GMT

Hi all,

I am running a Splunk 7.3.0 distributed / clustered environment and I have noticed that the DMC is reporting that disk usage on my indexers is high ie around the 85% mark, however Windows Server 2016 says that it is around 65% as per attached screenshot. Its mainly the F drive as far as I can tell.

Disk usage was high previously however I then implemented retention policies on the indexes which cleared out a large amount of data, is it possible the DMC is caching an old value and is not updating ? I have restarted the Cluster master node and we have rebooted the index cluster since then I believe.

Any info would be great,

Thanks

Re: Splunk Disk Reporting Incorrect

isoutamo — Wed, 14 Oct 2020 05:58:58 GMT

At lest in linux version you must restart splunk after you have added/increased FS/LVM/Disks. Without restart REST queries didn't show those correctly.
r. Ismo

Re: Splunk Disk Reporting Incorrect

trevor_dunstan8 — Thu, 15 Oct 2020 01:23:28 GMT

We haven't extended the disks on the servers so that solution doesn't apply to us.

Re: Splunk Disk Reporting Incorrect

trevor_dunstan8 — Thu, 15 Oct 2020 01:50:14 GMT

I thought that the Indexing cluster had been restarted but obviously not, storage figures reported correctly in DMC after cluster restart