https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426466#M122162 <P>Found the problem: the /opt/splunk/var/run/splunk/dispatch dir was a symlink to a different storage array on the old machine, and was broken when rsync-ing from the the old host to the replacement, which has a single large /opt/ mount for splunk. Deleting the broken symlink and making a proper dir and then copying data again from the original host cleared up the errors. </P> Mon, 05 Aug 2019 23:32:53 GMT dccrain 2019-08-05T23:32:53Z https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426463#M122159 <P>Recently I migrated one of our indexers to a new machine. </P> <P>Sometimes searches result in the below message despite there being plenty of space in the /opt/splunk mount and the minFreeSpace being set to 2000 in /opt/splunk/etc/system/local/server.conf.</P> <PRE><CODE>Dispatch Command: The minimum free disk space (18446744073709551615MB) reached for /opt/splunk/var/run/splunk/dispatch dispite [diskUsage]minFreeSpace = 2000 </CODE></PRE> Fri, 02 Aug 2019 23:59:53 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426463#M122159 dccrain 2019-08-02T23:59:53Z https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426464#M122160 <P>Well 18446744073 petabytes is a lot for just one indexer. I'd spread it out across... two indexers</P> Mon, 05 Aug 2019 21:27:34 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426464#M122160 nick405060 2019-08-05T21:27:34Z https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426465#M122161 <P>run a btool to check where is that config coming from. still its weird since you have the config in system/local</P> <PRE><CODE>/opt/splunk/bin/splunk btool server list --debug disk </CODE></PRE> <P>Also which Splunk version are you using?</P> Mon, 05 Aug 2019 23:23:16 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426465#M122161 diogofgm 2019-08-05T23:23:16Z https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426466#M122162 <P>Found the problem: the /opt/splunk/var/run/splunk/dispatch dir was a symlink to a different storage array on the old machine, and was broken when rsync-ing from the the old host to the replacement, which has a single large /opt/ mount for splunk. Deleting the broken symlink and making a proper dir and then copying data again from the original host cleared up the errors. </P> Mon, 05 Aug 2019 23:32:53 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-in-dispatch-command-message-quot-The-minimum-free/m-p/426466#M122162 dccrain 2019-08-05T23:32:53Z