topic Re: Linux Indexer root partition 100% full in Splunk Search

Linux Indexer root partition 100% full

johnklaiber — Fri, 10 Jan 2020 12:21:19 GMT

I had a previous case open on this (#1591420) but cannot seem to find it anymore.

In there Joe Love validated my idea to implement a move of our Splunk DB to a much larger partition and update Splunk config.

The referenced solution was the "easiest method' in this support case:
https://answers.splunk.com/answers/210748/splunk-amazon-ami-is-using-the-root-partition-to-s.html

As I was looking to implement this "easiest method" solution, for some reason our latest version of Splunk does not have the "/opt/splunk/splunk-launcher.cfg" file. We are version 7.3.0, has something changed since this original posting?

In fact, the .cfg files I see are in /etc and most are log- files. Is there a new file for updating the SPLUNK_DB= value?

Re: Linux Indexer root partition 100% full

soumyasaha25 — Fri, 10 Jan 2020 13:23:54 GMT

as per this doc the splunk-launch.conf file should be in "$SPLUNK_HOME/etc/ " directory.

if you want to change the location of SPLUNK_DB change it in splunk-launch.conf

NOTE:
This conf file is different from most splunk conf files. There is only one in the whole system, located at $SPLUNK_HOME/etc/splunk-launch.conf; further, there are no stanzas, explicit or implicit. Finally, any splunk-launch.conf files in etc/apps/... or etc/users/... will be ignored.

Re: Linux Indexer root partition 100% full

johnklaiber — Fri, 10 Jan 2020 14:03:29 GMT

Thank you. I did locate it and was able to restore functionality of the indexer.