https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218478#M1307 <P>Ahh 2p, that's right! </P> Wed, 10 Aug 2016 01:24:27 GMT skoelpin 2016-08-10T01:24:27Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218471#M1300 <PRE><CODE>Search not executed: The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch. user=wtaddis. </CODE></PRE> <P>Splunk Version<BR /> 6.3.1511</P> <P>Splunk Build<BR /> 8effae892620 </P> Mon, 08 Aug 2016 18:00:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218471#M1300 wtaddis 2016-08-08T18:00:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218472#M1301 <P>This is for a Splunk Enterprise Security Workshop</P> Mon, 08 Aug 2016 18:11:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218472#M1301 wtaddis 2016-08-08T18:11:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218473#M1302 <P>This could mean that your dispatch folder is "full" which will prevent you from doing any searches. This became full because too many searches we're going on in parallel and you don't have enough room on the file system. You can manually clear these files without any harm, this will just kill the search</P> <P>Or this means that your <CODE>opt</CODE> drive is full. Most likely your coldb is retaining a lot of old files and not moving them to the frozen bucket. Go to <CODE>/opt/splunk/var/lib/splunk/_internaldb</CODE> and do a <CODE>du -sh *</CODE> and see what is taking up space </P> <P>You could also go into the config file and decrease the file size needed which will temporarily fix your problem, but you will have the same issue again very quickly. This is in <CODE>server.conf</CODE> under the <CODE>[diskUsage]</CODE> stanza.. It should be like <CODE>minFreeSpace =xx</CODE></P> <P>Go look in your db and see what files are taking lots of room and delete some. You should then go to your <CODE>settings/indexes</CODE> and set a max size for your cold bucket to prevent this in the future. </P> Mon, 08 Aug 2016 18:31:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218473#M1302 skoelpin 2016-08-08T18:31:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218474#M1303 <P>Thanks. Since this is a Splunk Enterprise Security Workshop located in the Splunk Cloud would the configuration take place in Splunk's infrastrucure.? Thanks again.</P> Mon, 08 Aug 2016 18:41:05 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218474#M1303 wtaddis 2016-08-08T18:41:05Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218475#M1304 <P>I also want to describe what the dispatch folder does for more clarity.. </P> <P>The dispatch dir will house "artifacts" and these searches will be "cached" in the dispatch directory so you can load up searches faster. I believe the scheduled searches are relative to the timespan of the search, so if you have a long timespan then this will live in the dispatch folder for a longer period of time (Could be days). So to sum it up, if you have a lot of scheduled searches AND they have a big timespan specified, then this will quickly clog up your dispatch folder. So you will need to increase the size, decrease the amount of scheduled searches, decrease the timespan in those scheduled searches or decrease the minimum free disk space </P> Mon, 08 Aug 2016 19:02:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218475#M1304 skoelpin 2016-08-08T19:02:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218476#M1305 <P>Yes on the indexer</P> Mon, 08 Aug 2016 19:11:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218476#M1305 skoelpin 2016-08-08T19:11:08Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218477#M1306 <P>Here's an answer from a previous post on this topic for further reading <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> <A href="https://answers.splunk.com/answers/213571/what-causes-too-many-search-jobs-found-in-the-disp.html#answer-421843">https://answers.splunk.com/answers/213571/what-causes-too-many-search-jobs-found-in-the-disp.html#answer-421843</A></P> Wed, 10 Aug 2016 00:32:26 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218477#M1306 ppablo 2016-08-10T00:32:26Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218478#M1307 <P>Ahh 2p, that's right! </P> Wed, 10 Aug 2016 01:24:27 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unable-to-run-Security-Posture-in-the-Splunk-Cloud-sandbox-with/m-p/218478#M1307 skoelpin 2016-08-10T01:24:27Z