topic Re: Minimum disk usage(5000MB) on Search head error in Splunk Search

Minimum disk usage(5000MB) on Search head error

ramprakash — Thu, 11 Jul 2019 16:13:45 GMT

Hi Guys,

I have my searches disabled on Search heads as the default minimum free disk space is 5000MB.

Problem is my splunk configuration. I have splunk installed on two different file system. One FS is for Search head pooling(NAS).

Where and what changes should be make to avoid this error.

                  265G  905M  251G   1% **/APPLICATIONS/SPLUNKT**

                  9.9G  5.0G  5.0G  50% **/APPLICATIONS/SPLUNKT/Global_Storage** --- Search head pooling

Re: Minimum disk usage(5000MB) on Search head error

jimmytpowers — Thu, 11 Jul 2019 16:26:34 GMT

Hello ramprakash,

If it won't affect your performance, you can add a [diskUsage] stanza in server.conf, right now your minFreeSpace is 5Gb, you can lower that threshold to 1Gb or you can add more storage.

Below will help remove the error, and show the instance as healthy, but won't address the storage issue, if there is one.

$SPLUNK_HOME/etc/system/local/server.conf

[diskUsage]
minFreeSpace = 1000

Cheers,

Re: Minimum disk usage(5000MB) on Search head error

ramprakash — Thu, 11 Jul 2019 16:50:17 GMT

Thank you. But I have two different File system where Splunk is installed on Search head..Exactly where to make changes ?

One File system is for NAS(Search head pooling)

Re: Minimum disk usage(5000MB) on Search head error

jimmytpowers — Thu, 11 Jul 2019 17:03:39 GMT

I would add the server.conf stanza on the NAS instance, and possibly look into the below if it doesn't resolve the issue.

https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Manageconfigurationchanges

Re: Minimum disk usage(5000MB) on Search head error

ramprakash — Thu, 11 Jul 2019 17:23:29 GMT

Thank you so much for helping.I will do the changes and update you..

Can i make this server.conf change via Splunk Web ?

Re: Minimum disk usage(5000MB) on Search head error

jimmytpowers — Thu, 11 Jul 2019 17:32:05 GMT

You can change via server.conf, CLI or Splunk Web 🙂

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Setlimitsondiskusage

remember to select your correct version of Splunk on the top right

Re: Minimum disk usage(5000MB) on Search head error

jimmytpowers — Thu, 11 Jul 2019 19:04:00 GMT

How did it work out for you?

Re: Minimum disk usage(5000MB) on Search head error

woodcock — Thu, 11 Jul 2019 20:38:57 GMT

Search Head Pooling is a deprecated feature so the only way to get rid of the warning is to NOT USE IT (please don't; it is TERRIBLE and will result in all manner of outages and intermittent errors).

Re: Minimum disk usage(5000MB) on Search head error

jimmytpowers — Thu, 11 Jul 2019 21:25:12 GMT

SH Clustering is the way to go!!!

Re: Minimum disk usage(5000MB) on Search head error

woodcock — Fri, 12 Jul 2019 01:27:14 GMT

Well, IMHO, SHC stinks, too, but FAR less and it gets better every release and at some point it will be fine.