topic Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty. in Splunk Search

Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

mcxrisley08 — Wed, 21 Mar 2018 11:39:30 GMT

So I keep getting this error:

Dispatch Command: The minimum free disk space (3000MB) reached for /opt/splunk/var/run/splunk/dispatch.

So I went in and manually cleaned out the folder using rm -rf yesterday and the error still persists this morning even when the directory is completely empty. Has anyone else had this issue before?

Re: Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

richgalloway — Wed, 21 Mar 2018 12:49:59 GMT

The message is not saying the dispatch directory is full. It is saying the disk containing the dispatch directory doesn't have at least 3GB of free space.

You've cleaned up the dispatch directory. Next, look at the rest of the disk (using du or your favorite tool) to find where space can be recovered.

Re: Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

mcxrisley08 — Fri, 23 Mar 2018 14:31:19 GMT

I got it fixed shortly after posting this. You were correct , the /opt directory was full and clearing out some space allowed to start searching again. Thanks!

Re: Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

richgalloway — Mon, 26 Mar 2018 12:56:11 GMT

If your problem is resolved, please accept the answer to help future readers.