https://community.splunk.com/t5/Alerting/Error-while-uploading-file/m-p/381099#M6711 <P>You may have two problems, with the first caused by the second. Let's address the more important one first. Your disk is too full. As one of the error messages says: "Increase free disk space on partition '/' by removing or relocating data."</P> Fri, 17 May 2019 21:18:21 GMT richgalloway 2019-05-17T21:18:21Z https://community.splunk.com/t5/Alerting/Error-while-uploading-file/m-p/381098#M6710 <P>I am new to splunk, and this it my first time using splunk. I am trying to upload a json config file, and is getting the below error:<BR /> <STRONG>Upload failed with ERROR : Read Timeout</STRONG></P> <P>Also, the health status of splunkd is showing red, in GUI with the below messages:<BR /> Root Cause(s):<BR /> The diskspace remaining=3793 has breached the red threshold for filesystems=[/opt/splunk/var/lib/splunk/audit/db]<BR /> Last 50 related messages:<BR /> 05-17-2019 12:14:12.028 -0700 ERROR DiskMon - The index processor has paused data flow. Current free disk space on partition '/' has fallen to 3793MB, below the minimum of 4500MB. Data writes to index path '/opt/splunk/var/lib/splunk/audit/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data.</P> <P>Root Cause(s):<BR /> The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data.<BR /> Last 50 related messages:<BR /> 05-17-2019 12:22:36.317 -0700 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...<BR /> 05-17-2019 12:14:12.089 -0700 INFO TailReader - State transitioning from 1 to 0 (initOrResume).<BR /> 05-17-2019 12:14:12.089 -0700 INFO TailReader - State transitioning from 1 to 0 (initOrResume).<BR /> 05-17-2019 12:14:12.085 -0700 INFO TailReader - batchreader0 waiting to be un-paused<BR /> 05-17-2019 12:14:12.085 -0700 INFO TailReader - Starting batchreader0 thread<BR /> 05-17-2019 12:14:12.085 -0700 INFO TailReader - Registering metrics callback for: batchreader0<BR /> 05-17-2019 12:14:12.085 -0700 INFO TailReader - tailreader0 waiting to be un-paused<BR /> 05-17-2019 12:14:12.085 -0700 INFO TailReader - Starting tailreader0 thread<BR /> 05-17-2019 12:14:12.085 -0700 INFO TailReader - Registering metrics callback for: tailreader0</P> <P>How get this rectified and proceed with uploading the file</P> Fri, 17 May 2019 20:44:06 GMT https://community.splunk.com/t5/Alerting/Error-while-uploading-file/m-p/381098#M6710 panqa 2019-05-17T20:44:06Z https://community.splunk.com/t5/Alerting/Error-while-uploading-file/m-p/381099#M6711 <P>You may have two problems, with the first caused by the second. Let's address the more important one first. Your disk is too full. As one of the error messages says: "Increase free disk space on partition '/' by removing or relocating data."</P> Fri, 17 May 2019 21:18:21 GMT https://community.splunk.com/t5/Alerting/Error-while-uploading-file/m-p/381099#M6711 richgalloway 2019-05-17T21:18:21Z