topic Re: FULL STORAGE IN Deployment Server in Splunk Enterprise Security

FULL STORAGE IN Deployment Server

Unnamed16 — Fri, 19 Jul 2024 10:03:44 GMT

I am wondering why Deployment Server is full and the only stored in this server is Deployment Server Ta’s and .Conf to distribute the TA’s and Conf to Universal Forwarders.

this is the Specs.

Deployment Server

- 16 CPU Core (or 32 vCPU – if VM then must be dedicated), 2 GHz+ per core or greater
- 16GB RAM
- 1 x 200GB storage space (for OS and Splunk)
- 64-bits OS Linux/Windows
- 10GB Ethernet NIC, with optional 2nd NIC for management network

but the disk Space is full in /root

Please help Thank you

Re: FULL STORAGE IN Deployment Server

richgalloway — Fri, 19 Jul 2024 15:01:32 GMT

The specs listed are the *minimums* specified by Splunk. What the *actual* specs of the DS? Which version of Splunk is the DS running? How many apps are in the deployment-apps directory?

Splunk does not use /root to store anything and Best Practice is to put $SPLUNK_HOME and $SPLUNK_DB in separate mount points not shared with the OS.

Have you run du to see what files/directories are using the most storage?

Re: FULL STORAGE IN Deployment Server

Unnamed16 — Mon, 22 Jul 2024 07:48:06 GMT

Hi Rich, thank you for your info ill check this and ill be back to you